Docker Image Enumeration via API

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•8

This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.