detection rulehost

Docker systemd override audit

HostDocker systemd override audit

sudo find /etc/systemd/system/docker.service.d -name 'override.conf*' -ls

Posts using this rule

mediumSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
The pwn script writes `/etc/systemd/system/docker.service.d/override.conf` with a cleaned `ExecStart=`. Any unexpected presence of this file on a host the operations team has not configured is suspect.
2026-06-10