Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Suspicious PAN-OS Captive Portal Access
Cortex XDR
Detects anomalous or repetitive access to PAN-OS Captive Portal HTTP endpoints which may indicate active scanning for CVE-2026-0300 vulnerability exposure.
CVE-2026-0300 Scanner Tool User-Agent
Cortex XDR
Detects the use of the CVE-2026-0300 scanner tool by its distinct User-Agent string attempting to identify vulnerable PAN-OS Captive Portals.
Identifies network connections targeting port 6082, commonly used by the PAN-OS User-ID portal and specifically targeted in the CVE-2026-0300 PoC exploit to deliver a buffer overflow payload.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
Detects the creation of an AF_ALG socket (address family 38) by a non-root user. This is a highly unusual action and serves as a primary early warning indicator for CVE-2026-31431 (Copy Fail) exploitation attempts.
Detects authentication or privilege escalation events where a user account that is normally unprivileged suddenly reports as UID 0. This is a direct artifact of modifying the page cache of /etc/passwd in memory, which is the primary post-exploitation phase of the Copy Fail vulnerability (CVE-2026-31431).
This rule detects the execution of a Python proof-of-concept script named 'exp.py' followed by the execution of the 'su' binary on the same Linux host within a 5-minute window. This correlation is indicative of an attempt to exploit the 'Copy Fail' vulnerability (CVE-2026-31431), which leverages AF_ALG sockets to perform an in-memory page cache overwrite of the 'su' setuid binary to gain a root shell.
Detects Python processes potentially exploiting CVE-2026-31431 ("Copy Fail") by looking for command-line arguments referencing the 'authencesn' cryptography template or known Proof of Concept script names. This exploits a vulnerability in the AF_ALG socket type and splice() to escalate privileges.
This rule detects the execution of Python interpreters on Linux systems where the command line contains a specific AF_ALG cryptography template. This template is associated with a known vulnerability (CVE-2026-31431) and is considered highly suspicious due to its rarity in legitimate command lines. The detection targets the 'authencesn(hmac(sha256),cbc(aes))' string within the Python command line arguments.
This rule detects commands executed on Linux systems to mitigate the 'Copy Fail' vulnerability (CVE-2026-31431) related to the 'algif_aead' kernel module. It specifically looks for the dynamic unloading of the module using 'rmmod algif_aead' or the configuration of 'modprobe' to prevent the module from loading by setting 'install algif_aead /bin/false' in a modprobe configuration file.
Page 4 of 30