detection rulehost

daemon.json.disabled-by-dockerpwn fallback artifact

Hostdaemon.json.disabled-by-dockerpwn fallback artifact

sudo find /etc/docker -name 'daemon.json*' -ls

Posts using this rule

mediumSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
Fallback name written when no JSON parser is available. Its presence is a direct indicator of the script reaching its degraded branch.
2026-06-10