{
  "technique_id": "T1612",
  "name": "Build Image on Host",
  "tactics": [
    "Stealth"
  ],
  "platforms": [
    "Containers"
  ],
  "summary": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote <code>build</code> request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it...",
  "generated_by": "SOC Response Atlas by Basyrix"
}