Malicious Container Image Pull from Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.