""ET INFO External Host Creating Docker Image""
SID: 2031584
Revision: 3
Class Type: misc-activity
Metadata: attack_target Server, created_at 2021_01_28, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag Docker, updated_at 2023_06_23
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: [2375,2376]
Flow: established,to_server
Contents:
-
Value: "POST|20|" Depth: 5
-
Value: "images/create?fromImage="
-
Value: !"|0d 0a|Referer|3a|"
Within:
PCRE:
Special Options: