Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1204.003

T1204.003Malicious Image

T1204.003 — Malicious Image is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 18 detection use cases covering it and 5 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
18Use cases
5Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1204 · User Execution

Use cases covering this technique (18)

ASL AWS ECR Container Upload Outside Business Hours ESCU actions · hunting P ASL AWS ECR Container Upload Unknown User ESCU actions · hunting P AWS ECR Container Scanning Findings High ESCU actions · alerting P AWS ECR Container Scanning Findings Low Informational Unknown ESCU actions · hunting P AWS ECR Container Scanning Findings Medium ESCU actions · hunting P AWS ECR Container Upload Outside Business Hours ESCU actions · hunting P AWS ECR Container Upload Unknown User ESCU actions · hunting P Risk Rule for Dev Sec Ops by Repository ESCU actions · alerting P Cisco Isovalent - Non Allowlisted Image Use ESCU actions · hunting P Cisco Isovalent - Pods Running Offensive Tools ESCU actions · hunting P Correlation by Repository and Risk ESCU actions · alerting P Correlation by User and Risk ESCU actions · alerting P [LLM] npm preinstall hook executing node setup.mjs (Shai-Hulud dropper) Bespoke install · alerting DSΣPDDCS [LLM] Malicious 'anthropickit' PyPI package installed via pip (supply-chain cred stealer) Bespoke install · alerting DSΣPDDCS [LLM] Shai-Hulud / GhostAction malicious workflow artifact dropped on runner or repo checkout Bespoke delivery · hunting DSΣPDDCS [LLM] Malicious @velora-dex/sdk (9.4.1/9.4.2) pulled into GitHub Actions build runner Bespoke delivery · alerting DSΣPDDCS [LLM] npm/node install-time payload: package manager spawning curl/launchctl/osascript on a runner Bespoke exploit · hunting DSΣPCS [LLM] PHP CLI drops hidden /tmp dropper artefacts (Laravel-Lang autoload payload) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (5)

high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
crit Anthropic's Fever Dream: Claude's package that stole real keys art-156
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-221
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-257
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417