Docker Socket Abuse via curl

Brandon Rodriguez@BMRodriguez

•updated Jun 1, 2026•3•0•11

Identifies instances where curl is used to interact with a mounted Docker Unix socket. This technique is used to issue API commands directly to the Docker daemon, often to deploy new privileged containers for host escape.