DEF CON 34 – Rochester/Gould – OCI registry abused for SSRF / credential theft / container escape

Ankit Mehta@Secvyn

•updated Aug 13, 2026•4•0•12

This rule detects suspicious outbound network connections from common container runtime processes (e.g., containerd.exe, dockerd.exe) to well-known cloud instance metadata services (169.254.169.254, 100.100.100.200) or suspicious attempts to access container image manifests, which are indicative of SSRF attacks, credential theft from the metadata API, or potential container escape attempts.