🐳 Docker Socket Honeypot

Fake Docker daemon API capturing container escape attempts.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

Expose a fake Docker socket (/var/run/docker.sock) that appears unprotected. Attackers attempting container escape via Docker socket mounting interact with a fully monitored fake daemon that logs all commands.

Implementation requirements

Custom Docker API emulator (or Whaler)
Mounted at expected paths in honey containers
Full command logging with caller identity
Network isolation to prevent actual container spawning
Rollback: Stop the fake daemon and remove the socket file.
Upkeep: Keep the fake daemon's version responses current. Monthly proof-of-life command.

Technologies

ContainerLinux

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1610 Deploy Container	Execution	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — High-interaction Docker and Kubernetes honeypots were attacked within minutes; attackers requested privileged containers on the open Docker daemon and created Pods and a DaemonSet to run XMRig. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — An exposed Docker API honeypot received 850 attacks in 50 days; Kinsing was the most common. MITRE ATT&CK Enterprise v20.0 — T1610 procedure examples: TeamTNT, Kinsing and Doki deploy containers via exposed container APIs.
T1496 Resource Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero (474 miners tracked). Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On the Kubernetes honeypot, nearly all attacks aimed solely to run XMRig. MITRE ATT&CK Enterprise v20.0 — T1496.001: TeamTNT, Kinsing and Hildegard mine cryptocurrency on Docker and Kubernetes.
T1496.001 Compute Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1496.001 Compute Hijacking as an adversary behaviour.
T1133 External Remote Services	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) MITRE ATT&CK Enterprise v20.0 — T1133 covers VPN, Citrix and other remote access; procedure example: TeamTNT exploited exposed Docker API ports and kubelets for initial entry. Container Orchestration Honeypot: Observing Attacks in the Wild — Exposed Docker and Kubernetes honeypots on default ports attracted attackers within minutes. Cowrie — SSH and Telnet honeypot — An exposed SSH/Telnet honeypot logs brute-force and successful logins. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1611 Escape to Host	Privilege Escalation	confirmed	strong	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the honeypot escaped the container to the host (chroot to the host filesystem) and set up persistence there via SSH keys and crontab.

Evidence

Whaler — Docker Daemon API honeypot — oncyberblog (GitHub) industry
Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — Palo Alto Networks Unit 42 2021 industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard

Research basis: oncyberblog/whaler (GitHub, 2019-2020) — Docker/container honeypot mimicking insecure Docker Daemon API.