Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects commands used to disable or unload the 'algif_aead' kernel module. This activity is the recommended emergency mitigation for the "Copy Fail" vulnerability (CVE-2026-31431). Monitoring this ensures visibility into mitigation deployment across infrastructure and helps identify unauthorized tampering with kernel cryptographic capabilities.
This rule detects the execution of a process on a Linux system where the command line contains a specific URL associated with the 'Copy Fail Exploit Download' (CVE-2026-31431). This indicates an attempt to download or execute a known exploit.
Detects Python processes creating AF_ALG sockets with the 'authencesn' crypto template, which could indicate exploitation of CVE-2026-31431. This rule specifically looks for Python interpreter executions on Linux systems where the command line contains both 'socket.socket(38' (representing AF_ALG family) and 'authencesn'.
Detects commands used to flush system kernel caches via drop_caches. In the context of the CVE-2026-31431 (CopyFail) vulnerability, flushing caches is the primary method to recover the 'su' binary after it has been corrupted by the public Proof-of-Concept exploit.
Detects discovery commands checking for the presence of the vulnerable 'algif_aead' kernel module. Checking if this module is loaded is a prerequisite step for both defenders mitigating the threat and attackers profiling targets for CVE-2026-31431 (CopyFail).
Detects the download of the public proof-of-concept exploit script for CVE-2026-31431 (CopyFail) from the known payload domain 'copy.fail'. Attackers or testers may use utilities like curl or wget to retrieve the payload directly to a vulnerable system.
Detects alerts generated by page-cache integrity checking tools (e.g., pagecache_diff.py) indicating a divergence between a file's in-memory page cache and its on-disk representation. This is a primary post-exploitation indicator for the Copy Fail vulnerability (CVE-2026-31431), which corrupts the page cache without modifying the physical file to bypass traditional File Integrity Monitoring (FIM).
Detects administrative actions to disable or unload the 'algif_aead' kernel module. Monitoring for this activity helps defenders verify successful automated deployment (e.g., via Ansible) of the recommended security fix for CVE-2026-31431 (CopyFail).
Identifies emails spoofing NIPR, NAIC, or Stripe domains with invoice-related lures that fail authentication. This rule specifically looks for emails where the sender's domain (SenderFromDomain or SenderMailFromDomain) is one of the targeted domains (nipr.com, naic.org, stripe.com), the subject contains keywords like 'invoice' or 'past due', and the email authentication details do not indicate a 'pass'. This combination suggests a phishing attempt leveraging brand impersonation and financial urgency.
Detects the execution of the 'dvr' downloader script and subsequent 'nexuscorp' payload executions used by the Nexcorium Mirai variant botnet. This rule specifically looks for `wget` downloading 'dvr' from an IP address, direct execution of './dvr', or execution of 'nexuscorp' with an architecture-specific 'dvr' payload.
Page 5 of 30