CVE-2026-43503 DirtyClone PoC Execution – Root Shell from Unprivileged User

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

This rule detects activities related to the DirtyClone exploit (CVE-2026-43503), including the execution of the exploit binary, the compilation of the exploit from source code using gcc, the use of unshare to prepare network and user namespaces, and suspicious execution of su by non-standard parent processes indicating potential post-exploit root shell acquisition.