Docker Exec Command Run in Running Container

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects when a 'docker exec' command is run against a running container. It specifically looks for HTTP POST requests to the '/exec' endpoint, which is used by the Docker API to create and start an exec instance inside a container. This activity could indicate an attacker gaining interactive access to a compromised container.