{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/elastic-container-registry-ecr/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elastic Container Registry (ECR)"],"_cs_severities":["medium"],"_cs_tags":["cloud","aws","container-security","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eThis brief focuses on identifying anomalous container image management activity within Amazon Web Services (AWS) environments, specifically targeting unauthorized pushes to the AWS Elastic Container Registry (ECR). Adversaries or malicious insiders may attempt to push malicious or backdoored container images into a registry to facilitate downstream execution, persistence, or lateral movement within a containerized CI/CD pipeline or orchestration environment. By monitoring AWS CloudTrail logs via Amazon Security Lake, security teams can isolate instances where the 'PutImage' API operation is invoked by identities not previously categorized as authorized developers or automated build systems. This approach provides visibility into potential supply chain compromise attempts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation could result in the deployment of compromised or malicious container images across an organization's infrastructure. Unauthorized images may contain backdoors, malware, or hardcoded credentials, leading to full container escapes, data exfiltration, or secondary access within the cloud environment. Organizations leveraging automated deployment pipelines are particularly vulnerable to these malicious images being automatically promoted to production clusters.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMaintain and regularly update an allowlist of authorized IAM entities (users, roles, and service accounts) permitted to push images to production ECR repositories.\u003c/li\u003e\n\u003cli\u003eIngest AWS CloudTrail logs via Amazon Security Lake into your SIEM to monitor for 'PutImage' API activity.\u003c/li\u003e\n\u003cli\u003eEstablish alerting thresholds for 'PutImage' events originating from source IP addresses or user agents outside of known developer workstations or CI/CD runner environments.\u003c/li\u003e\n\u003cli\u003eImplement and enforce ECR image scanning to detect known vulnerabilities in images before they are deployed to orchestration platforms.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T02:18:24Z","date_published":"2026-10-14T02:18:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aws-ecr-unauthorized-upload/","summary":"This detection identifies potential unauthorized container image pushes to AWS ECR by monitoring for 'PutImage' API calls from users not present in an established allowlist, a common indicator of supply chain or lateral movement activity.","title":"Detection of Unauthorized Container Image Uploads to AWS ECR","url":"https://feed.craftedsignal.io/briefs/2026-10-aws-ecr-unauthorized-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Elastic Container Registry (ECR)","version":"https://jsonfeed.org/version/1.1"}