Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects write operations or modifications to 'uid_map', 'gid_map', or 'setgroups' files within the /proc directory.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
The xfrm-ESP variant of the Dirty Frag (CVE-2026-43284) vulnerability relies on creating new user and network namespaces, and mapping user/group IDs to root (0) to gain CAP_NET_ADMIN privileges. This setup phase allows the exploit to bypass namespace restrictions and register malicious XFRM Security Associations.
Note: Traditional auditd watches cannot monitor the /proc pseudo-filesystem directly. This detection relies on EDRs or eBPF-based sensors that can hook into file operations.
Detects the addition of RxRPC tokens to the process keyring using the `add_key` system call or `keyctl` command.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
The RxRPC variant of the Dirty Frag (CVE-2026-43500) vulnerability leverages malicious RxRPC v1 tokens to perform an offline brute-force attack and achieve local privilege escalation via a page-cache write.
Monitoring for unexpected RxRPC key additions helps identify potential exploitation of this vulnerability.
Detects a process modifying multiple privileged namespace mapping files (uid_map, gid_map, setgroups) under /proc. This behavior is used by the Dirty Frag xfrm-ESP exploit variant to gain CAP_NET_ADMIN privileges prior to exploiting the Linux kernel page-cache write vulnerability.
Detects attempts to bind an AF_ALG socket to the pcbc(fcrypt) cryptographic cipher. The Dirty Frag (CVE-2026-43500) RxRPC exploit variant leverages this highly unusual cryptographic combination to perform offline key brute-forcing in user-space to predict decrypted file offsets. This rule covers eBPF telemetry arguments, standard command-line logging (to catch potential kernel `modprobe` triggers), and auditd SOCKADDR hex-encoded structures.
Nginx or Crash Log Deletion
Cortex XDR
Detects command-line activity indicating the deletion of crash core dump files or Nginx logs. This behavior was observed by CL-STA-1132 as a defense evasion technique to cover tracks after exploiting CVE-2026-0300.
CL-STA-1132 Specific User-Agent
Cortex XDR
Detects network traffic utilizing the highly specific and anomalous User-Agent string used by CL-STA-1132 during the exploitation and post-exploitation of CVE-2026-0300.
Detects the creation of specific file names used by CL-STA-1132 for EarthWorm and ReverseSocks5 tunneling tools in /tmp/ and /var/tmp/ directories. These file names are highly specific to the CL-STA-1132 campaign.
Detects the Node.js process making external DNS requests to api64.ipify.org, a behavior used by the PhantomRaven payload to discover the host's public IP address.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP). This rule specifically looks for connections to 'pack.nppacks.com', 'hblnew.ecompk.com', or the IP address '54.160.138.70'.
Detects HTTP network connections to the specific exfiltration endpoint (mozbra.php) used by PhantomRaven to exfiltrate stolen CI/CD tokens and developer credentials.
Page 3 of 30