ATT&CK T1611 - Docker TLS API Access Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects attempts to access the Docker TLS API on port 2376. It triggers an alert if there are 5 or more TCP SYN packets (indicating connection attempts) from a single source to the Docker TLS API port within a 60-second window. This could indicate an attacker attempting to gain unauthorized access or control over Docker containers.