Docker socket access probing for container escape post-compromise

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects command-line activity indicating an attempt to interact with or abuse the Docker socket (/var/run/docker.sock) for container escape. Such activity is often observed in post-compromise scenarios, such as ransomware attacks where an adversary attempts to break out of a containerized application to gain control of the underlying host.