Docker Container Enumeration via API

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to enumerate Docker containers via the Docker API. Specifically, it looks for HTTP requests to the '/containers/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity is indicative of an adversary trying to discover running containers on a compromised host.