ECS/EC2 Container Image Deploy from Unexpected or Suspicious Registry (T1610)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•2•0•7

Detects the deployment of container images in AWS ECS or EC2 via RunInstances or RegisterTaskDefinition from registries other than Amazon Elastic Container Registry (ECR) or public ECR. This rule identifies potentially unauthorized or untrusted container sources, which could indicate an adversary attempting to deploy malicious images for persistence or exploitation.