Docker Socket Container Escape Probing Post-Compromise

Ibrahim Saud@tektrix

•updated 19 days ago•0•0•3

This rule detects processes attempting to interact with the Docker daemon via its Unix domain socket (/var/run/docker.sock). This is a common technique used by attackers to escape from a container, gain host-level control, or execute arbitrary container administration commands.