Detection: ASL AWS ECR Container Upload Unknown User

Created: 2024-05-22 Last Updated: 2026-05-13 ID: 886a8f46-d7e2-4439-b9ba-aec238e31732 Author: Patrick Bareiss, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized.

Search

 1`amazon_security_lake`
 2api.operation=PutImage
 3NOT `aws_ecr_users_asl`
 4
 5
 6| fillnull
 7
 8
 9| stats count min(_time) as firstTime
10              max(_time) as lastTime
11
12  by actor.user.uid api.operation api.service.name
13     http_request.user_agent
14     src_endpoint.ip actor.user.account.uid
15     cloud.provider cloud.region
16
17
18| rename actor.user.account.uid as vendor_account
19         actor.user.uid as user
20         api.operation as action
21         api.service.name as dest
22         cloud.provider as vendor_product
23         cloud.region as vendor_region
24         http_request.user_agent as user_agent
25         src_endpoint.ip as src
26
27
28| `security_content_ctime(firstTime)`
29
30| `security_content_ctime(lastTime)`
31
32| `asl_aws_ecr_container_upload_unknown_user_filter`

Data Source

Name	Platform	Sourcetype	Source
ASL AWS CloudTrail	AWS	`'aws:asl'`	`'aws_asl'`

Macros Used

Name	Value
amazon_security_lake	`sourcetype=aws:asl`
asl_aws_ecr_container_upload_unknown_user_filter	`search *`

asl_aws_ecr_container_upload_unknown_user_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1204.003	Malicious Image	Execution

Installation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Dev Sec Ops

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
Container uploaded from unknown user [$user$].	user	user	20

Threat Objects

Field	Type
src	ip_address

References

https://attack.mitre.org/techniques/T1204/003/

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`aws_asl`	`aws:asl`
Integration	✅ Passing	Dataset	`aws_asl`	`aws:asl`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 13