Wiki › Techniques, Tactics & Procedures (TTPs) › Persistence › Golden Image Backdooring

Golden Image Backdooring

2 min read

Jump to:

Overview

Golden Image Backdooring is a technique where adversaries compromise a master system image used for deploying multiple endpoints or servers by embedding malicious code or backdoors. This technique enables attackers to persistently infect all systems provisioned from the compromised image, facilitating widespread access and control early in the attack lifecycle. Adversaries leverage this method to establish persistence and stealth across an organization’s infrastructure.

Attack Objective

Establish persistent, covert access across multiple systems
Supports Initial Access, Persistence, Execution, and Privilege Escalation stages
Advances attacker position by compromising foundational deployment assets, enabling large-scale compromise with minimal additional effort

How the Technique Works

Attackers gain access to the environment where golden images or templates are created or stored, then modify these images to include malicious components such as backdoors, remote access tools, or credential harvesters. When new systems are provisioned from these images, the embedded malware activates, granting attackers control or stealthy access. This approach leverages the trust and widespread use of the golden image to propagate compromise at scale.

Common Methods & Variations

Modifying on-premises virtual machine templates or physical system images before deployment
Altering cloud-based machine images or container images used for automated provisioning
Injecting malicious scripts, binaries, or configuration changes into images
Using living-off-the-land binaries or legitimate tools embedded within images to evade detection

Indicators of Compromise (IOCs)

Unexpected changes or unauthorized modifications in image repositories or version control systems
Presence of unknown or suspicious binaries, scripts, or scheduled tasks in deployed systems
Unusual network connections or command and control activity originating from newly provisioned hosts
Alerts from integrity monitoring tools on image files or deployment pipelines

Detection Strategies

Monitoring image repositories and build pipelines for unauthorized changes or anomalous activity
Behavioral analysis of newly provisioned systems for unexpected processes or network connections
File integrity monitoring on golden images and deployed endpoints
Correlation of deployment events with security telemetry to identify deviations from baseline

Mitigation & Prevention

Implement strict access controls and multi-factor authentication for image creation and storage environments
Use cryptographic signing and verification of golden images before deployment
Regularly audit and monitor image repositories and build pipelines for unauthorized changes
Apply least privilege principles to deployment and provisioning systems

Response Considerations

Immediately isolate and restrict access to compromised image repositories and build systems
Conduct forensic analysis to identify scope of image modifications and affected deployments
Rebuild and redeploy clean images after thorough validation and remediation
Review and strengthen controls around image management and provisioning processes

Related Techniques

Supply Chain Compromise – leveraging trusted software or hardware components
Persistence via Implantation in System Firmware or Bootkits
Credential Access – harvesting credentials from compromised images
Lateral Movement – using compromised systems provisioned from backdoored images

Mapping & References

MITRE ATT&CK: Initial Access (T1078), Persistence (T1543), Defense Evasion (T1564)
Public research on supply chain and image compromise incidents from cybersecurity firms and CERT advisories
Industry best practices for secure image management and deployment pipelines

Tags: Attack Lifecycle Cloud Security Cybersecurity Techniques Defense Evasion endpoint security Execution Incident Response Initial Access persistence privilege escalation