Skip to content
.ca
sign in
detection rulehost

docker logs audit for PWN COMPLETE / dockerpwn

First seen
2026-06-16
Last seen
2026-06-16
Used in
1 post
Hostdocker logs audit for PWN COMPLETE / dockerpwn
sudo journalctl --since "30 days ago" | grep -E 'PWN (COMPLETE|INCOMPLETE)|dockerpwn'

Posts using this rule

  • mediumSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet

    Host

    The pwn script's terminal stdout contains the distinctive `[+] PWN COMPLETE` / `[!] PWN INCOMPLETE` banners. If the host's Docker daemon used `--log-driver=journald` or `--log-driver=local` at the time of compromise, these strings may survive in `journalctl` or per-container log files even after the carrier container is auto-removed.