DirtyClone CVE-2026-43503 Unprivileged-to-Root Escalation via Kernel Page-Cache Corruption
Detects a sequence of events consistent with the DirtyClone/DirtyFrag kernel exploit: first, identifying precursor activities such as namespace manipulation (unshare), kernel module loading of networking components (esp4/6, rxrpc), or specific exploit binary execution; followed by an anomalous spawn of a root shell from an unprivileged parent process within a short 5-minute window.
Microsoft Sentinel (KQL)
