Docker Container Cron Job Created via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.