Detection rules › Splunk
AWS ECR Container Upload Outside Business Hours
The following analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) outside of standard business hours. It leverages AWS CloudTrail logs to identify PutImage events occurring between 8 PM and 8 AM or on weekends. This activity is significant because container uploads outside business hours can indicate unauthorized or suspicious activity, potentially pointing to a compromised account or insider threat. If confirmed malicious, this could allow an attacker to deploy unauthorized or malicious containers, leading to potential data breaches or service disruptions.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1204.003 User Execution: Malicious Image |
Event coverage
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS ECR Container Upload Unknown User (Splunk)
- ECR CRUD Actions (Panther)
Rule body splunk
name: AWS ECR Container Upload Outside Business Hours
id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
version: 12
creation_date: '2021-08-19'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
description: The following analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) outside of standard business hours. It leverages AWS CloudTrail logs to identify `PutImage` events occurring between 8 PM and 8 AM or on weekends. This activity is significant because container uploads outside business hours can indicate unauthorized or suspicious activity, potentially pointing to a compromised account or insider threat. If confirmed malicious, this could allow an attacker to deploy unauthorized or malicious containers, leading to potential data breaches or service disruptions.
data_source:
- AWS CloudTrail PutImage
search: |-
`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 OR date_wday=saturday OR date_wday=sunday
| rename requestParameters.* as *
| rename repositoryName AS repository
| rename user_name as user
| stats count min(_time) as firstTime max(_time) as lastTime
BY signature user user_agent
src vendor_account vendor_region
vendor_product repository
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_ecr_container_upload_outside_business_hours_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: When your development is spreaded in different time zones, applying this rule can be difficult.
references:
- https://attack.mitre.org/techniques/T1204/003/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
intermediate_findings:
entities:
- field: user
type: user
score: 20
message: Container uploaded outside business hours from $user$
threat_objects:
- field: src
type: ip_address
analytic_story:
- Dev Sec Ops
asset_type: AWS Account
mitre_attack_id:
- T1204.003
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: network
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_container_upload/aws_ecr_container_upload.json
sourcetype: aws:cloudtrail
source: aws_cloudtrail
test_type: unit
Stages and Predicates
Stage 1: search
`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20 OR date_hour<8 OR date_wday=saturday OR date_wday=sunday
Stage 2: rename
| rename requestParameters.* as *
Stage 3: rename
| rename repositoryName AS repository
Stage 4: rename
| rename user_name as user
Stage 5: stats
| stats count min(_time) as firstTime max(_time) as lastTime
BY signature user user_agent
src vendor_account vendor_region
vendor_product repository
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `aws_ecr_container_upload_outside_business_hours_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
eventSource | eq |
|
sourcetype | eq |
|