| suricata | ATTACK Docker create body binds host root filesystem | 1 | 2026-06-16 |
| suricata | ATTACK Docker create body uses chroot for host-namespace escape | 1 | 2026-06-16 |
| suricata | ATTACK dockerpwn persistence script delivery in HTTP request body | 1 | 2026-06-16 |
| suricata | ATTACK Inbound Docker Engine API container create from external source | 1 | 2026-06-16 |
| suricata | ATTACK Inbound Docker Engine API exec/start from external source | 1 | 2026-06-16 |
| suricata | ATTACK 'Polly for Sonya' Cyrillic-language Docker pwn tooling marker | 1 | 2026-06-16 |
| suricata | C2 VoidLink agent binary download (fleet-agent-linux) | 1 | 2026-06-16 |
| suricata | C2 VoidLink agent enrolment (POST /api/agents/enroll) | 1 | 2026-06-16 |
| suricata | C2 VoidLink agent WebSocket channel (GET /ws/agent) | 1 | 2026-06-16 |
| suricata | C2 VoidLink bootstrap fetch, token-shape key (EXPERIMENTAL) | 1 | 2026-06-16 |
| suricata | C2 VoidLink bootstrap install script fetch | 1 | 2026-06-16 |
| suricata | POLICY Inbound Docker Engine API container create from internal source | 1 | 2026-06-16 |
| suricata | POLICY Inbound Docker Engine API exec/start from internal source | 1 | 2026-06-16 |
