detection rulehost

/tmp/pwn.sh content signature

Host/tmp/pwn.sh content signature

sudo find / -name 'pwn.sh' -type f 2>/dev/null | xargs -r grep -l 'Universal Docker Pwn Script'

Posts using this rule

highSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
A world-readable shell script at `/tmp/pwn.sh` matching the dockerpwn body is the immediate-aftermath artifact.
2026-06-10