CVE-2026-33634 Google Chronicle · YARA-L

Detect Aquasecurity Trivy Embedded Malicious Code (CVE-2026-33634) in Google Chronicle

CVE-2026-33634 describes an embedded malicious code vulnerability (CWE-506) in Aquasecurity Trivy, a widely-used open-source vulnerability scanner. A compromised or trojanized Trivy binary may execute attacker-controlled code during container image scanning, CI/CD pipeline runs, or Kubernetes admission checks. Because Trivy is frequently granted elevated permissions to access container registries, Kubernetes API servers, and cloud credential chains, a backdoored instance poses critical supply-chain risk: exfiltration of secrets, lateral movement into CI/CD infrastructure, and persistent implant installation. This detection monitors for anomalous process behavior, unexpected network egress, and suspicious file activity originating from Trivy processes.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Exfiltration

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule trivy_malicious_code_cve_2026_33634 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects anomalous behavior from Trivy processes indicative of CVE-2026-33634 embedded malicious code"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-69fq-xp46-6x23"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        re.regex($e.principal.process.file.full_path, `(?i)(trivy|trivy-linux-amd64|trivy-linux-arm64)$`)
        OR re.regex($e.target.process.file.full_path, `(?i)(trivy|trivy-linux-amd64|trivy-linux-arm64)$`)
      )
      AND (
        re.regex($e.principal.process.file.full_path, `(?i)(trivy|trivy-linux-amd64|trivy-linux-arm64)$`)
        AND re.regex($e.target.process.file.full_path, `(?i)(curl|wget|nc|ncat|python3?|perl|ruby)$`)
      )
    )
    OR
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      AND re.regex($e.principal.process.file.full_path, `(?i)(trivy|trivy-linux-amd64|trivy-linux-arm64)$`)
      AND NOT (
        ($e.target.port = 443 OR $e.target.port = 80)
        AND re.regex($e.target.hostname, `(?i)(aquasecurity|ghcr\.io|github\.com|api\.github\.com)$`)
      )
    )
    OR
    (
      $e.metadata.event_type = "FILE_CREATION"
      AND re.regex($e.principal.process.file.full_path, `(?i)(trivy|trivy-linux-amd64|trivy-linux-arm64)$`)
      AND re.regex($e.target.file.full_path, `(?i)^(/tmp/|/var/tmp/|/dev/shm/)`)
    )

  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L 2.0 rule detecting Trivy process tree anomalies — suspicious child spawning, unauthorized network egress, and temp-path file writes — consistent with CVE-2026-33634 malicious code execution.

Data Sources

Google Chronicle SIEMChronicle Endpoint TelemetryChronicle UDM Events

Required Tables

UDM Events (PROCESS_LAUNCH, NETWORK_CONNECTION, FILE_CREATION)

False Positives & Tuning

  • Trivy vulnerability database fetch to a private mirror not covered by the hostname allowlist
  • Trivy scan result pipelines that write JSON output to /tmp before shipping to a collector
  • CI systems where trivy runs inside a container and child processes are part of the scan wrapper
  • Legitimate security automation that wraps trivy output with python or bash post-processors

Other platforms for CVE-2026-33634

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Trivy Binary Hash Verification Failure Simulation

    Expected signal: ProcessRollup or DeviceProcessEvents event for /tmp/trivy-test with a SHA-256 hash differing from the official trivy binary hash; file creation event for /tmp/trivy-test.

  2. Test 2Trivy Spawning Reverse Shell Child Process

    Expected signal: ProcessRollup event showing trivy (or trivy-named process) as parent of nc/netcat; NetworkConnect event for local port 14444.

  3. Test 3Trivy Unexpected Outbound Network Connection

    Expected signal: NetworkConnect event from a process named 'trivy' (via exec -a) to 169.254.169.254 port 80; DnsRequest or direct IP connection telemetry.

  4. Test 4Trivy Writing Dropper to Temp Directory

    Expected signal: FileCreate event showing a trivy-named process writing an executable file to /dev/shm/; file hash and permissions captured in endpoint telemetry.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all hosts and containers running Trivy: query asset inventory and container orchestration platforms (Kubernetes, Docker Swarm) for active trivy processes or images containing trivy binaries.
  2. Determine the exact Trivy binary version and checksum in use: run `trivy --version` and compute SHA-256 of the binary, then compare against published release checksums from the official Aquasecurity GitHub releases page.
  3. Review process tree and network connections for the trivy process: capture parent PID chain, all child processes spawned during the scan session, and all outbound network connections made by the trivy process.
  4. Check CI/CD pipeline logs for the time window around disclosed date (2026-03-26) to identify if any Trivy scans executed from potentially compromised binaries.
  5. Determine how Trivy was installed: package manager, direct binary download, container image pull, or embedded in a CI tool. Identify the install source and whether it was verified against an official signature.

Containment

  1. Immediately halt all Trivy scan jobs and remove or quarantine the Trivy binary from affected systems. Replace with a known-good version obtained directly from the official Aquasecurity GitHub releases with GPG signature verification.
  2. Revoke and rotate all secrets and credentials that Trivy had access to during potentially compromised scan sessions, including container registry tokens, Kubernetes service account tokens, and cloud IAM credentials used during scanning.
  3. Isolate any host or container that executed the potentially compromised Trivy binary from the internal network pending forensic review, particularly if anomalous outbound connections or unexpected child processes were observed.

Evidence Collection

  1. Collect full process tree dumps, open file descriptors, and network socket state from affected Trivy processes: `lsof -p <trivy_pid>`, `ss -tulpn`, `cat /proc/<pid>/maps`, and `/proc/<pid>/cmdline`.
  2. Preserve Trivy binary artifacts for forensic analysis: compute SHA-256, extract strings, and submit to malware analysis sandboxes. Retain CI/CD build logs, download receipts, and any container image layers containing the trivy binary.

Escalation Criteria

  • !Escalate immediately if network forensics confirm outbound connections from the trivy process to non-Aquasecurity/GitHub infrastructure, especially if DNS resolution or IP geolocation points to attacker-controlled infrastructure.
  • !Escalate if post-incident review identifies that secrets (container registry credentials, cloud IAM tokens, Kubernetes service account tokens) accessible to Trivy during scan sessions were subsequently observed in unauthorized API calls or access logs.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SHA-256 hash of the trivy binary at /usr/local/bin/trivy or equivalent install path — compare against official release checksums published at https://github.com/aquasecurity/trivy/releases
  • >Kernel audit logs (auditd) showing execve syscalls with trivy as parent process, particularly any non-trivy child processes
  • >DNS query logs from the host for any domains resolved during trivy process lifetime that are not official Aquasecurity, GitHub, or operator-configured mirror domains
  • >Container image layer digests if trivy was deployed via Docker/OCI image — verify image digest matches official aquasec/trivy image digest on GHCR

Tuning Guidance

Reduce false positive rate by building and maintaining an allowlist of legitimate Trivy-initiated DNS hostnames and IP ranges used by your organization's vulnerability DB mirrors and container registries. Tune the child process detection by enumerating any approved Trivy plugins installed in your environment and adding their binary names to an exclusion list. For the network egress rule, consider scoping to production CI/CD runner hosts and Kubernetes nodes where Trivy runs in an admission controller context, as those represent the highest-risk targets. If Trivy runs inside containers, correlate container image digests against the known-compromised version indicators rather than process name matching alone.

Hunting Queries

Hunt for all trivy binary variants across the environment, collect unique SHA-256 hashes, and surface any hash variants that have not been verified against the official Aquasecurity release checksums. High host counts with multiple hash variants are a strong indicator of tampering.

Hunting — KQL
kql 
DeviceProcessEvents
| where FileName in~ ("trivy", "trivy-linux-amd64", "trivy-linux-arm64")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), HostCount=dcount(DeviceName), CommandLines=make_set(ProcessCommandLine, 20) by SHA256, FileName
| where isnotempty(SHA256)
| extend KnownGoodHashes = dynamic([])
| extend HashVerdict = iif(SHA256 in (KnownGoodHashes), "known-good", "verify-required")
| order by HostCount desc
Hunting — SPL
spl 
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:syslog") process_name IN ("trivy","trivy-linux-amd64","trivy-linux-arm64") | stats dc(host) AS host_count, values(process_hash) AS hashes, earliest(_time) AS first_seen, latest(_time) AS last_seen BY process_name | sort -host_count

Atomic Red Team Tests

Test 1 Trivy Binary Hash Verification Failure Simulation
linux

Simulates the presence of a tampered Trivy binary by replacing the binary with a copy that has a modified byte, then running a scan to trigger process telemetry. Tests whether EDR and SIEM capture the anomalous binary hash.

Command

bash 
cp $(which trivy) /tmp/trivy-test && echo 'MALICIOUS' >> /tmp/trivy-test && chmod +x /tmp/trivy-test && /tmp/trivy-test --version 2>/dev/null || true; sha256sum /tmp/trivy-test

Cleanup

bash 
rm -f /tmp/trivy-test

Expected Telemetry

ProcessRollup or DeviceProcessEvents event for /tmp/trivy-test with a SHA-256 hash differing from the official trivy binary hash; file creation event for /tmp/trivy-test.

Expected Detection

Hash anomaly alert if SHA-256 allowlist is configured; process execution from /tmp path if temp-execution rules are in place.

Test 2 Trivy Spawning Reverse Shell Child Process
linux

Simulates the embedded malicious code behavior by wrapping trivy in a script that spawns a netcat listener child process during a scan, mimicking how a backdoored trivy might establish C2.

Command

bash 
cat > /tmp/trivy-wrapper.sh << 'EOF'
#!/bin/bash
# Simulate malicious trivy spawning a child
exec -a trivy bash -c 'nc -lvp 14444 &'
EOF
chmod +x /tmp/trivy-wrapper.sh && /tmp/trivy-wrapper.sh; sleep 2; kill $(lsof -t -i:14444) 2>/dev/null || true

Cleanup

bash 
rm -f /tmp/trivy-wrapper.sh; kill $(lsof -t -i:14444) 2>/dev/null || true

Expected Telemetry

ProcessRollup event showing trivy (or trivy-named process) as parent of nc/netcat; NetworkConnect event for local port 14444.

Expected Detection

Suspicious child process spawn rule triggers on trivy parent + nc child combination.

Test 3 Trivy Unexpected Outbound Network Connection
linux

Simulates malicious Trivy making an outbound connection to a non-Aquasecurity host by running curl from within a trivy-named process context, mimicking credential exfiltration behavior.

Command

bash 
cat > /tmp/evil-trivy.sh << 'EOF'
#!/bin/bash
# Simulate trivy making unauthorized outbound connection
exec -a trivy bash -c 'curl -s --connect-timeout 3 http://169.254.169.254/latest/meta-data/ -o /tmp/trivy-exfil.txt 2>/dev/null; echo exfil_attempt_complete'
EOF
chmod +x /tmp/evil-trivy.sh && /tmp/evil-trivy.sh

Cleanup

bash 
rm -f /tmp/evil-trivy.sh /tmp/trivy-exfil.txt

Expected Telemetry

NetworkConnect event from a process named 'trivy' (via exec -a) to 169.254.169.254 port 80; DnsRequest or direct IP connection telemetry.

Expected Detection

Suspicious network egress rule fires on trivy process connecting to non-approved destination on port 80; IMDS access from scanner process may also trigger cloud-specific IMDS abuse detections.

Test 4 Trivy Writing Dropper to Temp Directory
linux

Simulates embedded malicious code dropping a secondary payload to /dev/shm during a scan session, a common technique for in-memory staging.

Command

bash 
exec -a trivy bash -c 'echo -e "#!/bin/bash\necho payload_executed" > /dev/shm/trivy-update && chmod +x /dev/shm/trivy-update && ls -la /dev/shm/trivy-update'

Cleanup

bash 
rm -f /dev/shm/trivy-update

Expected Telemetry

FileCreate event showing a trivy-named process writing an executable file to /dev/shm/; file hash and permissions captured in endpoint telemetry.

Expected Detection

Suspicious file write rule fires on trivy process creating executable in /dev/shm/.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0010Exfiltration

Related Techniques

T1195.002Compromise Software Supply ChainT1059.004Unix ShellT1048Exfiltration Over Alternative Protocol

Same Tactic: Initial Access

Popular Detections