build Docker image

rule:
  meta:
    name: build Docker image
    namespace: host-interaction/container/docker
    authors:
      - william.ballenthin@mandiant.com
    scopes:
      static: function
      dynamic: thread
    att&ck:
      - Defense Evasion::Build Image on Host [T1612]
    references:
      - https://docs.docker.com/engine/api/v1.24/
  features:
    - or:
      - string: /^docker(\.exe)? build/
      - and:
        - match: send HTTP request
        - string: /\/v1\.[0-9]{1,2}\/build/
          description: docker API endpoint, e.g., /v1.24/build