Vulnerable algif_aead Module Discovery (CVE-2026-31431)
Detects discovery commands checking for the presence of the vulnerable 'algif_aead' kernel module. Checking if this module is loaded is a prerequisite step for both defenders mitigating the threat and attackers profiling targets for CVE-2026-31431 (CopyFail).
Sigma
