This is a classic attack path that was already captured by plenty of EDRs/XDRs/CWPPs a couple years ago.
Right, why is their login user in the docker group? Mine sure isn’t.
alt Hacker News
Right, why is their login user in the docker group? Mine sure isn’t.