Compromised Image Pulled from Untracked Registry

The running container image cannot be traced to a specific, approved build: it was pulled from an external or unapproved registry, built outside standard CI/CD, or has a non-deterministic tag like `:latest`. Provenance is missing, SBOM is unavailable, and the malicious content cannot be distinguished from a legitimate base.

Signals

  • •Container image reference resolves to a public Docker Hub or untracked registry
  • •Image tag is `:latest` or a non-version-pinned value
  • •No SBOM, no provenance attestation, no signature for the deployed image
  • •Image digest does not match any known internal build record

Pivot Actions

  1. 1.Pull the exact image digest from runtime (`crictl inspect`, `docker inspect`) and preserve it as evidence before any rollback
  2. 2.Inspect the image layers: `skopeo inspect` and `dive` to walk the layer history; identify the unexpected or suspicious layers
  3. 3.Query admission-controller logs (OPA Gatekeeper, Kyverno, AWS ECR enhanced scanning) for the image-pull event to identify who deployed it and when
  4. 4.If signature policy was bypassed, add temporary admission rules enforcing signature-verification and SBOM-presence on all new deployments
  5. 5.Build an emergency SBOM from the preserved image using Syft or Trivy to understand what is actually present

Alternate Evidence Sources

  • •Runtime inspection of the preserved image (skopeo inspect, dive, syft)
  • •Admission-controller audit logs (Gatekeeper, Kyverno) showing who deployed what
  • •Registry audit logs if the untracked registry has any audit at all
  • •Emergency-generated SBOM from the preserved image