Malicious Container Image Pushed to Internal Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.