Image Creation

Initial construction of a virtual machine image within a cloud environment. Virtual machine images are templates containing an operating system and installed applications, which can be deployed to create new virtual machines. Monitoring the creation of these images is important because adversaries may create custom images to include malicious software or misconfigurations for later exploitation. Examples:

• Azure Compute Service Image Creation
  • Example: Creating a virtual machine image in Azure using Azure CLI: az image create --resource-group MyResourceGroup --name MyImage --source MyVM
• AWS EC2 AMI (Amazon Machine Image) Creation
  • Example: Creating an AMI from an EC2 instance: aws ec2 create-image --instance-id i-1234567890abcdef0 --name "MyAMI" --description "An AMI for my app"
• Google Cloud Compute Engine Image Creation
  • Example: Creating a custom image using gcloud: gcloud compute images create my-custom-image --source-disk my-disk --source-disk-zone us-central1-a
• VMware vSphere
  • Example: Exporting a VM to create an OVF (Open Virtualization Format) template: This could later be imported into other environments with potential tampering.

This data component can be collected through the following measures:

Enable Cloud Platform Logging

• Azure: Enable "Activity Logs" to capture image-related events such as PUT requests to Microsoft.Compute/images.
• AWS: Use AWS CloudTrail to monitor CreateImage API calls.
• Google Cloud: Enable "Cloud Audit Logs" to track custom image creation events under compute.googleapis.com/images.

API Monitoring

• Monitor API activity to track the creation of new images using:
  • AWS SDK/CLI CreateImage.
  • Azure REST API for image creation.
  • Google Cloud Compute Engine APIs.

Cloud SIEM Integration

• Ingest cloud platform logs into a centralized SIEM for real-time monitoring and alerting.