Shell Spawned Inside Container via Docker API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to spawn a shell inside a container via the Docker API. Specifically, it looks for HTTP traffic directed to port 2375 (commonly used for the Docker API) containing the string "/bin/sh" in the client body, indicating a command to execute a shell.