Skip to content

Hide Navigation Hide TOC

Image Metadata (b597a220-6510-4397-b0d8-342cd2c58827)

contextual information associated with a virtual machine image, such as its name, resource group, status (active or inactive), type (custom or prebuilt), size, creation date, and permissions. This metadata is critical for understanding the state and configuration of virtual machine images in cloud environments. Examples:

  • Azure Compute Service Image Metadata Example:
    • Name: MyCustomImage
    • Resource Group: MyResourceGroup
    • State: Available
    • Type: Managed Image
  • AWS EC2 AMI Metadata Example:
    • Image ID: ami-1234567890abcdef0
    • Name: ProdImage
    • State: Available
    • Platform: Windows
  • Google Cloud Compute Engine Image Metadata Example:
    • Image Name: webserver-image
    • Project: my-project-id
    • Family: webserver
    • Source Disk: my-disk-id
  • VMware vSphere Template Metadata Example:
    • Name: LinuxTemplate
    • Disk Size: 40GB
    • Network Adapter: VM Network

This data component can be collected through the following measures:

Cloud Platform-Specific Tools

  • Azure:
    • Use Azure CLI to query metadata: az image show --name MyCustomImage --resource-group MyResourceGroup
  • AWS:
    • Use AWS CLI to describe AMI metadata: aws ec2 describe-images --image-ids ami-1234567890abcdef0
  • Google Cloud:
    • Use Google Cloud SDK to retrieve image metadata: gcloud compute images describe webserver-image

APIs

  • Azure: GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/images/{imageName}
  • AWS: DescribeImages API.
  • Google Cloud: GET https://compute.googleapis.com/compute/v1/projects/{project}/global/images/{image}.

Cloud Management Portals

  • View metadata directly from the cloud provider's management console or dashboard.

SIEM Integration

  • Aggregate metadata into SIEM platforms for centralized monitoring:
Cluster A Galaxy A Cluster B Galaxy B Level
Implant Internal Image - T1525 (4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f) Attack Pattern Image Metadata (b597a220-6510-4397-b0d8-342cd2c58827) mitre-data-component 1
Run Virtual Instance - T1564.006 (b5327dd1-6bf9-4785-a199-25bcbd1f4a9d) Attack Pattern Image Metadata (b597a220-6510-4397-b0d8-342cd2c58827) mitre-data-component 1
Image Metadata (b597a220-6510-4397-b0d8-342cd2c58827) mitre-data-component Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern 1
Image Metadata (b597a220-6510-4397-b0d8-342cd2c58827) mitre-data-component Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 1
Run Virtual Instance - T1564.006 (b5327dd1-6bf9-4785-a199-25bcbd1f4a9d) Attack Pattern Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 2
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Match Legitimate Resource Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) Attack Pattern 2