AN1261 Analytic 1261

Containers · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detection of container image build activity directly on the host using Docker or Kubernetes APIs. Defenders may observe Docker build requests, anomalous Dockerfile instructions (such as downloading code from unknown IPs), or creation of new images followed by immediate deployment. This behavior chain typically consists of an unexpected image creation event correlated with outbound network communication to non-standard or untrusted destinations.</p>

Detects: T1612 Build Image on Host
Part of: DET0459 Detection Strategy for Build Image on Host

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
docker:daemon	`docker build or POST /build API request`	DC0015 Image Creation
NSM:Flow	`outbound connections from host during or immediately after image build`	DC0082 Network Connection Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`RegistryAllowList`	Defines trusted registries for image pulls/builds. Builds referencing unapproved registries may indicate adversary behavior.
`NewImageThreshold`	Threshold for number of new custom images created in a given time window. Exceeding this threshold may indicate malicious builds.
`TimeWindow`	Defines correlation window (e.g., 5m) between suspicious build activity and subsequent network traffic anomalies.