Unauthenticated Docker API Exec Command

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to execute commands via an unauthenticated Docker API. Specifically, it looks for HTTP POST requests to the '/exec' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker daemon access. This could indicate an attacker attempting to gain control or execute arbitrary commands within Docker containers or the host system.