Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Linux Suspicious Docker Build Command Execution

The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. This is not a typical location for this activity and can indicate an actor adding a container for malicious future…

Description

The following analytic detects docker build being executed on Dockerfiles within the /tmp directory. This is not a typical location for this activity and can indicate an actor adding a container for malicious future actions.

Detection logic

Detection requirements

Platform
Containers

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_for_linux_eventid_1

Known benign triggers

  • Developers or administrators may occasionally use the /tmp directory for testing Docker builds in non-production environments. Filter based on known users or systems where this activity has been approved.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice