Changes made to a virtual machine image, including setting and/or control data (ex: Azure Compute Service Images PATCH)
| Name | Channel |
|---|---|
| AWS:CloudTrail | ModifyImageAttribute |
| docker:registry | push event of new image version from unrecognized user or context |
| ID | Name | Technique Detected |
|---|---|---|
| DET0334 | Detection Strategy for T1525 – Implant Internal Image | T1525 |