Docker cp Copyout Path Traversal Container Escape (exploitarium PoC)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

This rule detects potential container escape attempts by monitoring for malicious use of the 'docker cp' command with path traversal sequences (../) or the creation of suspicious files by the docker daemon outside of expected docker storage directories, which may indicate symlink injection attacks to modify files on the host filesystem.