Image Creation (b008766d-f34f-4ded-b712-659f59aaed6e)
Initial construction of a virtual machine image within a cloud environment. Virtual machine images are templates containing an operating system and installed applications, which can be deployed to create new virtual machines. Monitoring the creation of these images is important because adversaries may create custom images to include malicious software or misconfigurations for later exploitation. Examples:
- Azure Compute Service Image Creation
- Example: Creating a virtual machine image in Azure using Azure CLI:
az image create --resource-group MyResourceGroup --name MyImage --source MyVM
- Example: Creating a virtual machine image in Azure using Azure CLI:
- AWS EC2 AMI (Amazon Machine Image) Creation
- Example: Creating an AMI from an EC2 instance:
aws ec2 create-image --instance-id i-1234567890abcdef0 --name "MyAMI" --description "An AMI for my app"
- Example: Creating an AMI from an EC2 instance:
- Google Cloud Compute Engine Image Creation
- Example: Creating a custom image using gcloud:
gcloud compute images create my-custom-image --source-disk my-disk --source-disk-zone us-central1-a
- Example: Creating a custom image using gcloud:
- VMware vSphere
- Example: Exporting a VM to create an OVF (Open Virtualization Format) template: This could later be imported into other environments with potential tampering.
This data component can be collected through the following measures:
Enable Cloud Platform Logging
- Azure: Enable "Activity Logs" to capture image-related events such as PUT requests to
Microsoft.Compute/images. - AWS: Use AWS CloudTrail to monitor
CreateImageAPI calls. - Google Cloud: Enable "Cloud Audit Logs" to track custom image creation events under
compute.googleapis.com/images.
API Monitoring
- Monitor API activity to track the creation of new images using:
- AWS SDK/CLI
CreateImage. - Azure REST API for image creation.
- Google Cloud Compute Engine APIs.
- AWS SDK/CLI
Cloud SIEM Integration
- Ingest cloud platform logs into a centralized SIEM for real-time monitoring and alerting.