Title:
Docker Container Discovery Via Dockerenv Listing
Status:
test
Description:Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery
References:
-https://blog.skyplabs.net/posts/container-detection/
-https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker
Author: Seth Hanford
Date: 2023-08-23
modified:None
Tags:
- -'attack.discovery'
- -'attack.t1082'
Logsource:
- category: process_creation
- product: linux
Detection:
selection:
Image|endswith:
-'/cat'
-'/dir'
-'/find'
-'/ls'
-'/stat'
-'/test'
-'grep'
CommandLine|endswith:
'.dockerenv'
condition:
selection
Falsepositives:
-Legitimate system administrator usage of these commands
-Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered
Level:
low
