Docker API Queried for Container Environment Secrets

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.