Malicious Container Service Created via Docker API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.