Threat hunts for Docker
31 hunts covering Docker, each with a hypothesis, the queries that test it and what the hunt cannot see.
31 hunts
-
mediumResearch by Microsoft
Detection of Phishing and Agent-Driven Exfiltration
An intruder has used a phishing attack to bypass multi-factor authentication and is now using compromised productivity applications to exfiltrate data over a C2 channel.
3 query1 analytic1 checkpoint1 action2 taskexfiltration · initial access -
highResearch by Unit 42
Kubernetes Operator RBAC Abuse and Secret Theft
A vulnerable or outdated Kubernetes operator is running with excessive ClusterRole permissions, allowing an attacker to exfiltrate cluster-wide secrets or establish unauthorized AI agent bridges to external endpoints.
3 query1 analytic1 checkpoint2 taskCVE-2026-6389 -
mediumResearch by Huntress
AI Coding Agent Sandbox Activity
An unauthorized user is running an AI coding harness to modify production codebases, using automated testing to validate the changes and communicating with external LLM APIs.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · execution -
high Part 2 of 2Research by The DFIR Report
Bissa Scanner C2 and S3 Exfiltration
An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers.
3 query1 analytic1 checkpoint1 action2 taskCVE-2025-55182 · CVE-2025-9501 -
high Part 1 of 2Research by The DFIR Report
Bissa Scanner Mass Exploitation and Credential Harvesting
An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities in Next.js or WordPress, then harvesting sensitive credentials from .env files and cloud metadata.
3 query2 analytic2 checkpoint1 action2 taskCVE-2025-55182 · CVE-2025-9501 -
medium Part 2 of 2Research by Microsoft
Cloud Workload Identity and Network Triage
An adversary uses over-permissioned cloud identities to compromise container workloads, establishing persistence through rare outbound network channels that bypass standard scanning.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · defense evasion -
medium Part 1 of 2Research by Microsoft
Cloud Workload Runtime and Exploitation Behavior
An adversary has exploited a public-facing containerized application and is maintaining persistence through binary drift or suspicious shell execution within the workload runtime.
3 query2 analytic2 checkpoint1 action3 taskcommand and control · credential access · defense evasion -
high Part 1 of 2Research by Unit 42
Build-Time Execution and Secret Harvesting
An attacker has compromised a software dependency to execute malicious code during the build phase, subsequently harvesting cloud and developer credentials from the environment's configuration files.
3 query1 analytic1 checkpoint2 taskCVE-2024-3094 -
highResearch by Elastic Security Labs
Kubernetes Service Account Abuse and Escape
An intruder has harvested a service account token from a compromised pod and is using it to deploy a privileged pod for container escape, bypassing standard runtime process detection.
4 query2 analytic1 checkpoint1 action2 taskcredential access · discovery · execution -
highResearch by Elastic Security Labs
Bulk Directory Discovery via AAD Graph API
An adversary uses legacy Azure AD Graph API endpoints and known offensive Client IDs to perform bulk directory enumeration, specifically targeting internal API versions that expose sensitive authentication methods.
3 query2 analytic2 checkpoint1 action2 taskdiscovery · execution · initial access -
highResearch by Unit 42
SPIFFE/SPIRE Workload Identity Spoofing
An attacker with root access on a Kubernetes node is spoofing cgroup metadata to trick the SPIRE agent into issuing identities belonging to co-located workloads for unauthorized service impersonation.
4 query2 analytic1 checkpoint1 action3 taskcommand and control · credential access · defense evasion -
high Part 2 of 2Research by Huntress
Malicious C2 Infrastructure Polling
An intruder is communicating with AMOS or NetSupport RAT infrastructure through DNS lookups, direct socket connections, or specific HTTP paths, often utilizing processes running from temporary directories.
5 query1 analytic1 checkpoint1 action2 taskcollection · command and control · execution -
high Part 1 of 2Research by Huntress
Cross-Platform Malware Execution and Persistence
An intruder has compromised endpoints via a fake Google Doc lure, leading to user-driven execution of AMOS or NetSupport RAT loaders followed by persistence and credential staging.
3 query2 analytic2 checkpoint1 action2 taskcollection · command and control · execution -
high Part 2 of 2Research by Unit 42
ChainDrop Worm: Developer Tooling Persistence and Supply Chain Propagation
An adversary has compromised developer environments by injecting malicious hooks into IDE configuration files, using automated GitHub workflows to propagate an npm worm and resolve C2 via Ethereum smart contracts.
4 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · execution -
high Part 1 of 2Research by Unit 42
ChainDrop: NPM Worm Endpoint and CI Runner Activity
An intruder has infected an npm package and triggered a preinstall hook that uses the Bun runtime to harvest credentials from the filesystem and CI runner process memory.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · credential access · execution -
high Part 3 of 3Research by Datadog Security Labs
Shai-Hulud: Exfiltration and Deadman Switch
An attacker is using the Shai-Hulud framework to exfiltrate stolen credentials through GitHub dead-drops and has installed a destructive deadman switch that triggers a home-directory wipe if tokens are revoked.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · discovery -
high Part 2 of 3Research by Datadog Security Labs
Shai-Hulud Secret Harvesting and Discovery
An intruder has deployed the Shai-Hulud framework to extract credentials from filesystem paths and process memory, subsequently using them to automate the discovery of cloud and Kubernetes infrastructure secrets.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · credential access · discovery -
high Part 1 of 3Research by Datadog Security Labs
Shai-Hulud Framework Supply Chain Hook and Loader Bootstrap
The adversary poisons a developer repository or AI coding assistant configuration to execute the Shai-Hulud loader and establish daemonized persistence.
3 query2 analytic2 checkpoint1 action2 taskcommand and control · credential access · discovery -
mediumResearch by Elastic Security Labs
Suspicious ingress tool transfer via native utilities
An adversary is using native Linux or macOS utilities like curl or wget to download malicious payloads from external infrastructure, hiding their activity within the high volume of legitimate cloud automation.
3 query1 analytic1 checkpoint1 action2 taskcommand and control -
highResearch by Elastic Security Labs
Automated Triage Reproduction Monitoring
An attacker has submitted an exploit in a HackerOne report that successfully escapes the ephemeral reproduction sandbox or bypasses network egress filters during automated triage.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · execution · initial access -
mediumResearch by Microsoft
Exploitation and Obfuscated C2 in the Patch Window
An adversary has exploited a critical vulnerability in a public-facing web application during the window before patching and is using a multi-hop proxy to mask command-and-control traffic.
3 query2 analytic2 checkpoint1 action2 taskcommand and control · execution · initial access -
high Part 2 of 2Research by Unit 42
AMOS Stealer C2 and Exfiltration Patterns
An adversary exfiltrates keychain, browser, and wallet data from macOS hosts by sending a sequence of HTTP POST requests containing specific stage parameters to malicious infrastructure.
3 query1 analytic1 checkpoint1 action2 taskcollection · command and control · execution -
high Part 1 of 2Research by Unit 42
Atomic macOS (AMOS) Stealer Activity
An adversary has compromised a macOS host using deceptive Terminal setup commands to execute encoded shell scripts, establishing hidden persistence in Application Support and staging harvested data in temporary directories.
5 query2 analytic1 checkpoint1 action2 taskcollection · command and control · execution -
high Part 2 of 2Research by Cisco Talos
VoidLink Lateral Scanning and Mesh C2
An intruder is using a VoidLink implant to perform automated internal reconnaissance and establish a peer-to-peer mesh command-and-control network between compromised Linux servers.
3 query1 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 1 of 2Research by Cisco Talos
VoidLink: Exploitation and Kernel-Level Implant Deployment
An adversary has exploited a Java-based Apache Dubbo service to deploy a ZigLang-based VoidLink implant and maintained stealth using an unsigned kernel-level rootkit.
3 query2 analytic2 checkpoint1 action2 taskcommand and control · discovery · execution -
high Part 2 of 2Research by Microsoft
AI Infrastructure Host Monetization and Persistence
An attacker has compromised an AI gateway or retrieval engine and is now deploying masqueraded payloads to monetize the host via cryptomining and establish durable SSH or systemd persistence.
6 query2 analytic1 checkpoint1 action2 taskCVE-2025-68700 · CVE-2026-24770 -
high Part 1 of 2Research by Microsoft
AI Gateway Exploitation and Data Theft
An intruder has exploited an exposed AI gateway or orchestration platform to harvest LLM API keys from process memory and exfiltrate tenant configurations from backend databases.
3 query2 analytic2 checkpoint1 action2 taskCVE-2025-68700 · CVE-2026-24770 -
high Part 2 of 2Research by Unit 42
AI-Agentic Escalation and Infrastructure Hijacking
An automated AI agent loop is conducting high-speed privilege escalation via secrets managers, tampering with CI/CD configurations, and hijacking cloud AI endpoints for external orchestration.
4 query1 analytic1 checkpoint1 action2 taskcredential access · impact · initial access -
high Part 1 of 2Research by Unit 42
Automated Service Infiltration and Data Harvesting
An intruder is using autonomous AI agents to breach public web services and map internal microservices while harvesting credentials, leaving behind unique filesystem artifacts and high-frequency network recon patterns.
3 query1 analytic1 checkpoint1 action2 taskcredential access · impact · initial access -
highResearch by Datadog Security Labs
Local Privilege Escalation via Copy-Fail Page Cache Corruption
An unprivileged local attacker exploits CVE-2026-31431 by splicing AF_ALG crypto sockets into the page cache of sensitive system files to achieve root execution without modifying files on disk.
5 query2 analytic1 checkpoint1 action2 taskCVE-2026-31431 -
high Part 1 of 2Research by Wiz
TeamPCP Credential Validation and Discovery
An adversary validates stolen cloud credentials and enumerates cloud infrastructure using offensive tools like TruffleHog or specialized Boto3 scripts following a supply chain compromise.
4 query1 analytic1 checkpoint1 action2 taskdiscovery · execution · exfiltration