Malicious Dockerfile Submitted via Docker API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.