Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1204.003

T1204.003Malicious Image

T1204.003 — Malicious Image is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 16 detection use cases covering it and 3 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
16Use cases
3Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1204 · User Execution

Use cases covering this technique (16)

ASL AWS ECR Container Upload Outside Business Hours ESCU actions · hunting P ASL AWS ECR Container Upload Unknown User ESCU actions · hunting P AWS ECR Container Scanning Findings High ESCU actions · alerting P AWS ECR Container Scanning Findings Low Informational Unknown ESCU actions · hunting P AWS ECR Container Scanning Findings Medium ESCU actions · hunting P AWS ECR Container Upload Outside Business Hours ESCU actions · hunting P AWS ECR Container Upload Unknown User ESCU actions · hunting P Risk Rule for Dev Sec Ops by Repository ESCU actions · alerting P Cisco Isovalent - Non Allowlisted Image Use ESCU actions · hunting P Cisco Isovalent - Pods Running Offensive Tools ESCU actions · hunting P Correlation by Repository and Risk ESCU actions · alerting P Correlation by User and Risk ESCU actions · alerting P [LLM] Shai-Hulud / GhostAction malicious workflow artifact dropped on runner or repo checkout Bespoke delivery · hunting DSΣPDDCS [LLM] Malicious @velora-dex/sdk (9.4.1/9.4.2) pulled into GitHub Actions build runner Bespoke delivery · alerting DSΣPDDCS [LLM] npm/node install-time payload: package manager spawning curl/launchctl/osascript on a runner Bespoke exploit · hunting DSΣPCS [LLM] PHP CLI drops hidden /tmp dropper artefacts (Laravel-Lang autoload payload) Bespoke install · alerting DSΣPDDCS

Articles citing this technique (3)

high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-114
high Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp art-158
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-371