CARBONATO worm: Docker API container/image deploy on port 2375

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects anomalous activity associated with the CARBONATO worm, specifically monitoring for unauthorized creation of 'net-setup' containers or pulling 'system/resolved' images via the Docker API port 2375. Additionally, the rule identifies rapid, sequential network scanning behavior targeting the Docker API port across internal IP ranges.