Attack Chain

1. An attacker gains unauthorized access to an AWS account, possibly through compromised credentials or an IAM role with excessive privileges.
2. The attacker leverages the AWS CLI or API to authenticate to the AWS environment using the compromised credentials.
3. The attacker builds or obtains a malicious container image, potentially containing malware or backdoors.
4. The attacker attempts to upload the malicious container image to an AWS ECR repository using the PutImage API call.
5. CloudTrail logs this PutImage API call, including the user identity (actor.user.uid), source IP (src_endpoint.ip), and operation details.
6. The detection logic identifies the user as an unknown or unauthorized entity based on a lack of prior ECR upload activity.
7. Security personnel investigate the alert, examining the container image for malicious content and the user account for signs of compromise.
8. If malicious activity is confirmed, remediation steps include revoking compromised credentials, quarantining the container image, and investigating the scope of the breach.

Impact

Unauthorized container uploads to AWS ECR can have significant consequences. If successful, attackers can deploy malicious containers into production environments, leading to data breaches, system compromise, and service disruption. The scope of impact depends on the permissions granted to the compromised account or role and the nature of the deployed container. Depending on the compromised container's purpose, attackers could steal sensitive data, establish persistence, or launch further attacks within the AWS environment. The lack of known false positives suggests that any triggered alert warrants immediate investigation.

Recommendation

• Enable Amazon Security Lake and configure it to collect AWS CloudTrail logs from all relevant AWS accounts and regions to provide comprehensive visibility of ECR activity.
• Deploy the Sigma rule AWS ECR Container Upload by Unknown User to your SIEM and tune the rule based on your organization's known ECR user base.
• Investigate any alerts generated by this detection, focusing on the source IP address (src_endpoint.ip), user agent (http_request.user_agent), and the contents of the uploaded container image.
• Review IAM policies related to ECR to ensure that only authorized users and roles have the necessary permissions to upload container images.
• Implement multi-factor authentication (MFA) for all AWS accounts to reduce the risk of credential compromise.

Attack Chain

1. An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or exploiting a misconfigured IAM role.
2. The attacker uses the AWS CLI or AWS SDK to authenticate and interact with the ECR service.
3. The attacker crafts or obtains a malicious container image.
4. The attacker uses the PutImage API call to upload the malicious container image to a designated ECR repository. This occurs outside of established business hours to evade detection.
5. AWS CloudTrail logs the PutImage event, capturing details such as the actor's user ID, source IP address, and the target repository.
6. The malicious container image is then deployed within the AWS environment, potentially through ECS, EKS, or other container orchestration services.
7. The deployed container executes malicious code, leading to data exfiltration, lateral movement, or denial-of-service attacks.

Impact

A successful attack can result in the deployment of malicious code within the victim's AWS environment. This can lead to unauthorized access to sensitive data, service disruption, or complete compromise of the AWS account. The impact can vary based on the permissions associated with the deployed container and the attacker's objectives. Detecting and responding to these anomalous uploads promptly is crucial to mitigating potential damages.

Recommendation

• Deploy the provided Sigma rule to your SIEM and tune it for your specific business hours and AWS environment to detect suspicious container uploads (Sigma rule below).
• Investigate any alerts generated by the Sigma rule by reviewing the associated CloudTrail logs for further indicators of compromise.
• Monitor AWS CloudTrail logs for PutImage events and correlate them with other security events to identify potential patterns of malicious activity.
• Review IAM policies and access controls to ensure that only authorized users and roles have the necessary permissions to upload container images to ECR.
• Implement multi-factor authentication (MFA) for all AWS accounts to reduce the risk of credential compromise.
• Regularly audit and review AWS CloudTrail logs to identify and address any security misconfigurations or suspicious activity.
• Implement automated container image scanning to identify vulnerabilities and malware before they are deployed.

Attack Chain

1. An attacker gains unauthorized access to AWS credentials through compromised credentials, exposed keys, or other means.
2. The attacker uses these credentials to authenticate to the AWS environment.
3. The attacker creates or modifies a Docker image to include malicious software, backdoors, or other unwanted components.
4. The attacker uploads the malicious Docker image to an AWS ECR repository outside of normal business hours. This is done using the docker push command or AWS CLI.
5. A deployment pipeline or manual deployment process pulls the newly uploaded (malicious) container image from ECR.
6. The compromised container is deployed into a production or development environment.
7. The malicious code within the container executes, potentially leading to data exfiltration, privilege escalation, or denial of service.

Impact

A successful attack could lead to the deployment of compromised containers in the AWS environment. This can result in data breaches, service disruptions, or unauthorized access to sensitive resources. The impact is highly dependent on the nature of the malicious code injected into the container image. Early detection of unusual ECR upload activity outside business hours can help prevent or mitigate the impact of such attacks.

Attack Chain

1. An attacker gains unauthorized access to AWS credentials through methods like credential stuffing or phishing.
2. The attacker uses the compromised credentials to authenticate to the AWS environment via the AWS CLI or API.
3. The attacker crafts or obtains a malicious container image designed for nefarious purposes.
4. The attacker executes the aws ecr put-image command or uses the AWS API to upload the malicious container image to a specified ECR repository. This generates a CloudTrail PutImage event.
5. AWS ECR stores the container image.
6. The attacker deploys the malicious image using services like ECS or EKS.
7. The malicious container executes, potentially leading to data exfiltration, lateral movement, or denial-of-service attacks.

Impact

An unauthorized container image upload can severely compromise an AWS environment. A successful attack can lead to the deployment of malicious code within the infrastructure, potentially affecting critical applications and data. This can result in data breaches, service disruptions, and reputational damage. The absence of specific victim counts makes it challenging to quantify the exact scope, but the nature of the attack suggests potentially broad implications for organizations utilizing AWS ECR.

Recommendation

• Deploy the Sigma rule AWS ECR Container Upload by Unknown User to your SIEM and tune the aws_ecr_users macro for your environment.
• Investigate any alerts generated by the AWS ECR Container Upload by Unknown User Sigma rule to determine the source and intent of the unknown image upload.
• Implement multi-factor authentication (MFA) for all AWS accounts, especially those with permissions to upload container images to ECR.
• Regularly review and audit AWS IAM policies to ensure least privilege access for all users and roles.
• Monitor AWS CloudTrail logs for suspicious API calls and unusual activity, focusing on ECR-related events as specified in the "data_source" section.