CVE-2026-33634 Elastic Security · Elastic

Detect Aquasecurity Trivy Embedded Malicious Code (CVE-2026-33634) in Elastic Security

CVE-2026-33634 describes an embedded malicious code vulnerability (CWE-506) in Aquasecurity Trivy, a widely-used open-source vulnerability scanner. A compromised or trojanized Trivy binary may execute attacker-controlled code during container image scanning, CI/CD pipeline runs, or Kubernetes admission checks. Because Trivy is frequently granted elevated permissions to access container registries, Kubernetes API servers, and cloud credential chains, a backdoored instance poses critical supply-chain risk: exfiltration of secrets, lateral movement into CI/CD infrastructure, and persistent implant installation. This detection monitors for anomalous process behavior, unexpected network egress, and suspicious file activity originating from Trivy processes.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Exfiltration

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=2m
  [process where event.type == "start" and
   (process.name in ("trivy", "trivy-linux-amd64", "trivy-linux-arm64") or
    process.parent.name in ("trivy", "trivy-linux-amd64", "trivy-linux-arm64"))]
  [any where event.category in ("network", "file") and
   (
     (event.category == "network" and
      process.name in ("trivy", "trivy-linux-amd64", "trivy-linux-arm64") and
      not (destination.port in (443, 80) and
           destination.domain in ("aquasecurity.github.io", "ghcr.io", "github.com", "api.github.com")))
     or
     (event.category == "file" and
      process.name in ("trivy", "trivy-linux-amd64", "trivy-linux-arm64") and
      file.path like~ "/tmp/*" or file.path like~ "/dev/shm/*" or file.path like~ "/var/tmp/*")
     or
     (event.category == "process" and
      process.parent.name in ("trivy", "trivy-linux-amd64", "trivy-linux-arm64") and
      process.name in ("curl", "wget", "nc", "ncat", "python3", "python", "perl", "ruby"))
   )
  ]
critical severity medium confidence

EQL sequence rule correlating Trivy process start with subsequent suspicious network egress, temp file writes, or interpreter spawning within a 2-minute window — fingerprint of embedded malicious code execution.

Data Sources

Elastic Endpoint SecurityElastic Agent (system integration)

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.network-*logs-endpoint.events.file-*

False Positives & Tuning

  • Trivy running with custom plugin configurations that spawn helper processes
  • Scan result exporters writing temporary JSON to /tmp before upload
  • Network-connected vulnerability DB fetches to private mirror hosts not in the allowlist
  • Containerized Trivy instances where the host name matches multiple scan jobs simultaneously

Other platforms for CVE-2026-33634

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Trivy Binary Hash Verification Failure Simulation

    Expected signal: ProcessRollup or DeviceProcessEvents event for /tmp/trivy-test with a SHA-256 hash differing from the official trivy binary hash; file creation event for /tmp/trivy-test.

  2. Test 2Trivy Spawning Reverse Shell Child Process

    Expected signal: ProcessRollup event showing trivy (or trivy-named process) as parent of nc/netcat; NetworkConnect event for local port 14444.

  3. Test 3Trivy Unexpected Outbound Network Connection

    Expected signal: NetworkConnect event from a process named 'trivy' (via exec -a) to 169.254.169.254 port 80; DnsRequest or direct IP connection telemetry.

  4. Test 4Trivy Writing Dropper to Temp Directory

    Expected signal: FileCreate event showing a trivy-named process writing an executable file to /dev/shm/; file hash and permissions captured in endpoint telemetry.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all hosts and containers running Trivy: query asset inventory and container orchestration platforms (Kubernetes, Docker Swarm) for active trivy processes or images containing trivy binaries.
  2. Determine the exact Trivy binary version and checksum in use: run `trivy --version` and compute SHA-256 of the binary, then compare against published release checksums from the official Aquasecurity GitHub releases page.
  3. Review process tree and network connections for the trivy process: capture parent PID chain, all child processes spawned during the scan session, and all outbound network connections made by the trivy process.
  4. Check CI/CD pipeline logs for the time window around disclosed date (2026-03-26) to identify if any Trivy scans executed from potentially compromised binaries.
  5. Determine how Trivy was installed: package manager, direct binary download, container image pull, or embedded in a CI tool. Identify the install source and whether it was verified against an official signature.

Containment

  1. Immediately halt all Trivy scan jobs and remove or quarantine the Trivy binary from affected systems. Replace with a known-good version obtained directly from the official Aquasecurity GitHub releases with GPG signature verification.
  2. Revoke and rotate all secrets and credentials that Trivy had access to during potentially compromised scan sessions, including container registry tokens, Kubernetes service account tokens, and cloud IAM credentials used during scanning.
  3. Isolate any host or container that executed the potentially compromised Trivy binary from the internal network pending forensic review, particularly if anomalous outbound connections or unexpected child processes were observed.

Evidence Collection

  1. Collect full process tree dumps, open file descriptors, and network socket state from affected Trivy processes: `lsof -p <trivy_pid>`, `ss -tulpn`, `cat /proc/<pid>/maps`, and `/proc/<pid>/cmdline`.
  2. Preserve Trivy binary artifacts for forensic analysis: compute SHA-256, extract strings, and submit to malware analysis sandboxes. Retain CI/CD build logs, download receipts, and any container image layers containing the trivy binary.

Escalation Criteria

  • !Escalate immediately if network forensics confirm outbound connections from the trivy process to non-Aquasecurity/GitHub infrastructure, especially if DNS resolution or IP geolocation points to attacker-controlled infrastructure.
  • !Escalate if post-incident review identifies that secrets (container registry credentials, cloud IAM tokens, Kubernetes service account tokens) accessible to Trivy during scan sessions were subsequently observed in unauthorized API calls or access logs.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SHA-256 hash of the trivy binary at /usr/local/bin/trivy or equivalent install path — compare against official release checksums published at https://github.com/aquasecurity/trivy/releases
  • >Kernel audit logs (auditd) showing execve syscalls with trivy as parent process, particularly any non-trivy child processes
  • >DNS query logs from the host for any domains resolved during trivy process lifetime that are not official Aquasecurity, GitHub, or operator-configured mirror domains
  • >Container image layer digests if trivy was deployed via Docker/OCI image — verify image digest matches official aquasec/trivy image digest on GHCR

Tuning Guidance

Reduce false positive rate by building and maintaining an allowlist of legitimate Trivy-initiated DNS hostnames and IP ranges used by your organization's vulnerability DB mirrors and container registries. Tune the child process detection by enumerating any approved Trivy plugins installed in your environment and adding their binary names to an exclusion list. For the network egress rule, consider scoping to production CI/CD runner hosts and Kubernetes nodes where Trivy runs in an admission controller context, as those represent the highest-risk targets. If Trivy runs inside containers, correlate container image digests against the known-compromised version indicators rather than process name matching alone.

Hunting Queries

Hunt for all trivy binary variants across the environment, collect unique SHA-256 hashes, and surface any hash variants that have not been verified against the official Aquasecurity release checksums. High host counts with multiple hash variants are a strong indicator of tampering.

Hunting — KQL
kql 
DeviceProcessEvents
| where FileName in~ ("trivy", "trivy-linux-amd64", "trivy-linux-arm64")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), HostCount=dcount(DeviceName), CommandLines=make_set(ProcessCommandLine, 20) by SHA256, FileName
| where isnotempty(SHA256)
| extend KnownGoodHashes = dynamic([])
| extend HashVerdict = iif(SHA256 in (KnownGoodHashes), "known-good", "verify-required")
| order by HostCount desc
Hunting — SPL
spl 
index=endpoint sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational","linux:syslog") process_name IN ("trivy","trivy-linux-amd64","trivy-linux-arm64") | stats dc(host) AS host_count, values(process_hash) AS hashes, earliest(_time) AS first_seen, latest(_time) AS last_seen BY process_name | sort -host_count

Atomic Red Team Tests

Test 1 Trivy Binary Hash Verification Failure Simulation
linux

Simulates the presence of a tampered Trivy binary by replacing the binary with a copy that has a modified byte, then running a scan to trigger process telemetry. Tests whether EDR and SIEM capture the anomalous binary hash.

Command

bash 
cp $(which trivy) /tmp/trivy-test && echo 'MALICIOUS' >> /tmp/trivy-test && chmod +x /tmp/trivy-test && /tmp/trivy-test --version 2>/dev/null || true; sha256sum /tmp/trivy-test

Cleanup

bash 
rm -f /tmp/trivy-test

Expected Telemetry

ProcessRollup or DeviceProcessEvents event for /tmp/trivy-test with a SHA-256 hash differing from the official trivy binary hash; file creation event for /tmp/trivy-test.

Expected Detection

Hash anomaly alert if SHA-256 allowlist is configured; process execution from /tmp path if temp-execution rules are in place.

Test 2 Trivy Spawning Reverse Shell Child Process
linux

Simulates the embedded malicious code behavior by wrapping trivy in a script that spawns a netcat listener child process during a scan, mimicking how a backdoored trivy might establish C2.

Command

bash 
cat > /tmp/trivy-wrapper.sh << 'EOF'
#!/bin/bash
# Simulate malicious trivy spawning a child
exec -a trivy bash -c 'nc -lvp 14444 &'
EOF
chmod +x /tmp/trivy-wrapper.sh && /tmp/trivy-wrapper.sh; sleep 2; kill $(lsof -t -i:14444) 2>/dev/null || true

Cleanup

bash 
rm -f /tmp/trivy-wrapper.sh; kill $(lsof -t -i:14444) 2>/dev/null || true

Expected Telemetry

ProcessRollup event showing trivy (or trivy-named process) as parent of nc/netcat; NetworkConnect event for local port 14444.

Expected Detection

Suspicious child process spawn rule triggers on trivy parent + nc child combination.

Test 3 Trivy Unexpected Outbound Network Connection
linux

Simulates malicious Trivy making an outbound connection to a non-Aquasecurity host by running curl from within a trivy-named process context, mimicking credential exfiltration behavior.

Command

bash 
cat > /tmp/evil-trivy.sh << 'EOF'
#!/bin/bash
# Simulate trivy making unauthorized outbound connection
exec -a trivy bash -c 'curl -s --connect-timeout 3 http://169.254.169.254/latest/meta-data/ -o /tmp/trivy-exfil.txt 2>/dev/null; echo exfil_attempt_complete'
EOF
chmod +x /tmp/evil-trivy.sh && /tmp/evil-trivy.sh

Cleanup

bash 
rm -f /tmp/evil-trivy.sh /tmp/trivy-exfil.txt

Expected Telemetry

NetworkConnect event from a process named 'trivy' (via exec -a) to 169.254.169.254 port 80; DnsRequest or direct IP connection telemetry.

Expected Detection

Suspicious network egress rule fires on trivy process connecting to non-approved destination on port 80; IMDS access from scanner process may also trigger cloud-specific IMDS abuse detections.

Test 4 Trivy Writing Dropper to Temp Directory
linux

Simulates embedded malicious code dropping a secondary payload to /dev/shm during a scan session, a common technique for in-memory staging.

Command

bash 
exec -a trivy bash -c 'echo -e "#!/bin/bash\necho payload_executed" > /dev/shm/trivy-update && chmod +x /dev/shm/trivy-update && ls -la /dev/shm/trivy-update'

Cleanup

bash 
rm -f /dev/shm/trivy-update

Expected Telemetry

FileCreate event showing a trivy-named process writing an executable file to /dev/shm/; file hash and permissions captured in endpoint telemetry.

Expected Detection

Suspicious file write rule fires on trivy process creating executable in /dev/shm/.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0010Exfiltration

Related Techniques

T1195.002Compromise Software Supply ChainT1059.004Unix ShellT1048Exfiltration Over Alternative Protocol

Same Tactic: Initial Access

Popular Detections