Unverified Docker Image Pulled via Unauthenticated API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to pull a Docker image via an unauthenticated Docker API. Specifically, it looks for HTTP requests to the '/images/create' endpoint on port 2375, which is the default unauthenticated Docker API port. This activity could indicate an attacker exploiting an exposed Docker daemon to deploy malicious images or gain further access to the host system.