MITRE ATT&CK technique

Implant Internal Image detection rulesT1525

Implant Internal Image (T1525) is a MITRE ATT&CK technique in the Persistence tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1525 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target aws.

T1525 on attack.mitre.org1 rule

Tactic

Persistence

AWS ECS Task Definition That Queries The Credential Endpoint
medium
Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.
aws

Top products

Tactic

AWS ECS Task Definition That Queries The Credential Endpoint