Nmap IPv6 ExtLen Wrap PoC Compilation or Execution (exploitarium)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

This rule detects activities related to the 'ipv6_extlen_wrap_probe' proof-of-concept (PoC) exploit, which targets IPv6 extension header vulnerabilities. The detection logic monitors for: 1. Execution of the PoC binary, 2. Compilation of the PoC source code using common compilers like g++ or MinGW, 3. Creation of files associated with the PoC, and 4. Nmap execution with specific flags indicative of an attempt to trigger the vulnerability via raw IPv6 scanning.