Docker cp Copyout Path Traversal Container Escape (exploitarium PoC)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.