Docker cp Copyout Destination Path Traversal Container Escape

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•68

This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.