Docker Container List Enumerated via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to enumerate Docker containers via the Docker API by looking for HTTP requests containing the URI '/containers/json'. This activity could indicate an attacker performing reconnaissance on a compromised host to understand the running container environment.