Docker cp Copyout Path Traversal Container Escape Detection

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.