detection rulehost
/tmp/pwn.sh content signature
- First seen
- 2026-06-16
- Last seen
- 2026-06-16
- Used in
- 1 post
sudo find / -name 'pwn.sh' -type f 2>/dev/null | xargs -r grep -l 'Universal Docker Pwn Script'Posts using this rule
Host
A world-readable shell script at `/tmp/pwn.sh` matching the dockerpwn body is the immediate-aftermath artifact.