Docker Pull/Run Command Execution

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•5

Detects the execution of 'docker pull' or 'docker run' commands, excluding common base images like Microsoft, Ubuntu, Debian, and Alpine. This rule aims to identify potentially unauthorized container deployments or image pulls that could indicate malicious activity within a containerized environment.