Docker Container Enumeration

Danny Y@zendannyy

•updated Apr 28, 2026•3•0•231

This rule detects the execution of common system enumeration commands (lsblk, hostname, mount, uname) within a Docker container, when the container is run with privileged access. This activity could indicate an adversary attempting to glean information about the container environment.