Docker Image Built on Compromised Host via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.