ATT&CK T1611 - Docker Daemon API Access (Unauthenticated)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects unauthenticated access attempts to the Docker Daemon API, specifically targeting TCP port 2375. It triggers on the initial SYN packet of a TCP connection to this port, indicating an attempt to establish a connection to the Docker API without authentication. This activity is often associated with privilege escalation attempts, as an unauthenticated Docker API can be exploited to gain control over the host system.