Docker Version and VM Info Queried via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to query Docker version and virtual machine information via the Docker API. It specifically looks for HTTP requests to port 2375 (commonly used for Docker API) with a URI containing "/version". This activity could indicate reconnaissance by an attacker trying to gather information about the Docker environment.