CVE-2026-46331 PACKET_EDIT_MEME Exploit File Creation, Compile, and Execution Chain
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
Splunk (SPL)
