CVE-2026-31431 «Copy Fail» · Detection & IR Playbook

Attack Pattern — Kernel Memory Exploitation Chain

CVE-2026-31431 · authencesn AEAD · AF_ALG · splice()

🚨 Day Zero — What To Do RIGHT NOW ACTIVE EXPLOITATION

Step 1 · Am I Vulnerable?

Check kernel version and module status. If kernel is between 4.13–6.18 and algif_aead is accessible — you are exposed.

## Quick check:
uname -r
grep CONFIG_CRYPTO_USER_API_AEAD \
  /boot/config-$(uname -r)
## =y means BUILT-IN (high risk)
## =m means MODULE (can blacklist)

Step 2 · Am I Already Exploited?

Check auditd and auth.log for exploitation artifacts. No disk trace — only log-based detection works.

## Check auditd for AF_ALG:
ausearch -sc socket -i 2>/dev/null \
  | grep 'family=38'
## Check auth.log (Wiz signal):
grep -P 'su\[\d+\]:\s+\(to root\)\s+on' \
  /var/log/auth.log

Step 3 · Protect Now

Apply mitigation immediately. Then schedule kernel patch within 48 hours for critical systems.

## Debian/Ubuntu:
echo 'install algif_aead /bin/false' \
  > /etc/modprobe.d/disable-algif.conf
## RHEL-family (modprobe won't work!):
grubby --update-kernel=ALL \
  --args="initcall_blacklist=algif_aead_init"
reboot

↓ After completing these 3 steps, use the IR phases below if exploitation is confirmed ↓

7.8

CVSS Score (HIGH)

100%

Exploit Reliability

9 yrs

Vulnerability Window

732

Bytes to Root

Disk Writes (Stealth)

Hunt Queries

Vulnerability Profile

What Is Copy Fail

CVE-2026-31431 «Copy Fail» is a logic flaw in the Linux kernel's authencesn AEAD cryptographic template that allows any unprivileged user to overwrite the in-memory content of setuid binaries via a chain of three legitimate syscalls: socket(AF_ALG) + splice() + execve().

The vulnerability exists because the authencesn template fails to clear the SCATTERLIST_BIT_MUTABLE flag when accepting pipe-sourced pages into its AEAD destination scatterlist — allowing page-cache pages marked read-only to be written to. The attacker splices a setuid binary's read-only pages through a pipe into an AF_ALG socket, triggers the AEAD write path, and achieves a controlled 4-byte overwrite of the binary's ELF entry point in page-cache.

The result: any low-privileged user becomes root in a single script execution with 100% reliability, no race condition, and zero forensic artifacts on disk.

Why This Is Different

No Race Condition

Deterministic — first run always succeeds. No timing, no luck, no retries. Any script kiddie with a copy of the PoC can root your server.

Zero Disk Writes

Page-cache modification only. inotify silent. No EDR file-write alert. No audit trail for the payload. Looks like a ghost root process.

Universal Portability

Same 732-byte Python PoC. Same result. Ubuntu 22, RHEL 9, Debian 12, SUSE 15, Alpine, Amazon Linux — all vulnerable until patched.

Exploit Chain — 6 Steps to Root

Step 1

Open SUID Binary

open(/usr/bin/su, O_RDONLY) — read-only FD to setuid binary in page-cache

→

Step 2

Splice to Pipe

splice(fd, pipe) — page-cache pages referenced in pipe buffer

→

Step 3

Open AF_ALG Socket

socket(AF_ALG=38, SOCK_SEQPACKET) + authencesn algorithm bind

→

Step 4

Splice to Socket

splice(pipe, alg_socket) — pages enter AEAD dst scatterlist

→

Step 5

Trigger Write

sendmsg()+recvmsg() — authencesn writes 4 bytes to page-cache read-only page (ELF entry point)

→

Step 6

Execute → ROOT

execve(modified_setuid) — kernel loads from page-cache → shellcode runs as uid=0

Affected Environments

K8s nodes, CI/CD runnersCRITICAL

Multi-user SSH serversCRITICAL

Cloud VMs with shell accessHIGH

Container hosts (any runtime)HIGH

Dev laptops (single user)MEDIUM

Patch Information

Kernel Commit

a664bf3d603d

Fix Description

Reverts 2017 zero-copy optimization — pages from pipe now deep-copied instead of referenced in AEAD dst scatterlist

Ubuntu/Debian

apt update && apt install linux-image-generic

RHEL/Amazon Linux

yum update kernel -y

SUSE

zypper update kernel-default -y

Immediate Mitigation (No Reboot)

# Blacklist algif_aead module — blocks exploit Step 3 # Deploy NOW while preparing kernel patch echo 'blacklist algif_aead' | tee \ /etc/modprobe.d/blacklist-copy-fail.conf # Unload if currently loaded modprobe -r algif_aead 2>/dev/null # Verify — must return empty lsmod | grep algif_aead # Ansible fleet-wide deployment: ansible all -m shell -a "echo 'blacklist algif_aead' \ >> /etc/modprobe.d/blacklist-copy-fail.conf \ && modprobe -r algif_aead 2>/dev/null" -b

Phase 4 of 6 — Remediation

Objective

Deploy kernel patches across entire Linux fleet by distro. Execute Kubernetes rolling update (zero downtime). Verify 100% patch coverage before removing temporary mitigations.

Ubuntu / Debian

# Install patched kernel apt update && apt install -y linux-image-generic # Schedule reboot (maintenance window) shutdown -r +1 'CVE-2026-31431 kernel patch' # Post-reboot verify uname -r # confirm patched version lsmod | grep algif_aead # must be empty systemctl --failed # no failed services

RHEL / CentOS / Amazon Linux

# RHEL 8/9, Rocky, AlmaLinux, Oracle Linux yum update kernel -y # Amazon Linux 2 yum update kernel -y && reboot # Amazon Linux 2023 dnf update kernel -y && reboot # Verify changelog references fix rpm -q --changelog kernel | \ grep 'CVE-2026-31431'

Kubernetes Rolling Update (Zero Downtime)

# Repeat for each node — NOT parallel kubectl cordon <node-name> kubectl drain <node-name> \ --ignore-daemonsets \ --delete-emptydir-data \ --grace-period=300 # Patch kernel on node ssh <node> 'apt update && apt install -y \ linux-image-generic && shutdown -r now' # Wait for node ready kubectl wait --for=condition=Ready \ node/<node-name> --timeout=600s # Verify and uncordon kubectl debug node/<node-name> \ -it --image=busybox -- uname -r kubectl uncordon <node-name>

Fleet Verification

Fleet kernel check: ansible all -m shell -a 'uname -r' -b — all outputs must show patched version
Fleet module check: ansible all -m shell -a 'lsmod | grep algif_aead; echo CLEAR' -b | grep -v CLEAR — any hit = module still loaded
Run PoC in isolated lab on patched system — should exit with ENODEV or module not found error, document result
Remove temporary blacklist files after patch confirmed: ansible all -m file -a 'path=/etc/modprobe.d/blacklist-copy-fail.conf state=absent' -b
Update CMDB/asset inventory with patched kernel versions and patch completion timestamp

Intel Feed — CVE-2026-31431

Live threat intelligence, SOC detection methodology, patch status, and community findings. Updated continuously as new information emerges from vendors, researchers, and SOC teams worldwide. Last updated: 2 May 2026.

LAST UPDATED: 2026-05-02 · SOURCES: 12 · CLASSIFICATION: TLP:AMBER

🛡️ SOC Detection Methodology — VAPT vs SOC Perspective

VAPT tells you "this system is vulnerable" — kernel version check, module present. SOC must answer "has someone already exploited this?" — that answer lives in logs, process trees, and behavioral anomalies. Below is the complete SOC analyst workflow for detecting Copy Fail exploitation through log analysis.

SOC GUIDE Step-by-Step: How SOC Detects Copy Fail Exploitation from Logs Detection Playbook

STEP 1 Check auditd — AF_ALG Socket Creation (Primary Signal) HIGHEST CONFIDENCE

What you're looking for: Any non-root user creating an AF_ALG socket (family=38). This syscall has near-zero legitimate usage in production. If you see it — someone is attempting the exploit.

Log source: /var/log/audit/audit.log · Required: auditd running with Copy Fail rules deployed

# Search auditd for AF_ALG socket by non-root (last 7 days) ausearch -k copy_fail_afalg --start recent | grep 'uid=[^0]' # If auditd rules NOT yet deployed — search raw audit log: grep 'syscall=41.*a0=26' /var/log/audit/audit.log | grep -v 'uid=0' # Quick check — any AF_ALG socket created ever? ausearch -sc socket -i 2>/dev/null | grep -i 'family=38\|a0=26'

ANY HIT = P1 ALERT. Escalate immediately. Non-root AF_ALG socket creation has no legitimate use in 99.9% of environments.

STEP 2 Check auth.log — "Phantom Root" su Entry (Post-Exploitation) HIGH CONFIDENCE

What you're looking for: su log entries where the invoking username is MISSING. Normal su always logs who called it. Copy Fail corrupts the binary so PAM can't identify the caller — producing a "phantom" root entry. (Discovered by Wiz, 1 May 2026)

Log source: /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL)

✓ Normal su entry

su[1765]: (to root) alice on pts/1

⚠ Copy Fail exploitation

su[1781]: (to root) on pts/1

# Hunt for su entries with missing username grep -P 'su\[\d+\]:\s+$to root$\s+on\s+pts' /var/log/auth.log grep -P 'su\[\d+\]:\s+$to root$\s+on\s+pts' /var/log/secure # Compare: normal su entries always have a username before "on pts" grep 'su\[.*\]: (to root)' /var/log/auth.log | awk '{print}' # Splunk query index=linux_secure sourcetype=linux_secure "su" "(to root)" "on pts" | regex _raw="su\[\d+\]:\s+$to root$\s+on\s+pts"

STEP 3 Check auditd — UID=0 Transition Without sudo/su Ancestor HIGH CONFIDENCE

What you're looking for: Any execve() where uid≠0 but euid=0 (effective UID becomes root) — without a legitimate auth parent process (sudo, su, login, sshd, pam, polkit). This is the definitive "someone got root without authorization" signal. Works for any kernel LPE, not just Copy Fail.

Log source: /var/log/audit/audit.log · Key field: auid (audit login UID — tracks original user through privilege changes)

# Hunt: execve with uid!=0 but euid=0, excluding legitimate auth ausearch -m EXECVE -i 2>/dev/null | \ awk '/uid=/{if($0~/uid=0/) next; if($0~/euid=0/ && $0!~/(sudo|su|login|sshd|cron|pam|polkit)/) print}' # Alternative: search for copy_fail_lpe key if rules deployed ausearch -k copy_fail_lpe --start recent # Check auid field — this is the ORIGINAL login user # Even if they became root, auid stays as their real identity ausearch -m SYSCALL -sv yes 2>/dev/null | grep 'euid=0' | grep -v 'auid=0'

KEY INSIGHT: The auid (audit UID) field is immutable — it records who originally logged in. If auid=1001 but euid=0 with no sudo in the process tree, that user escalated privileges through an exploit.

STEP 4 Check Process Trees — Python from Temp Directories MEDIUM-HIGH

What you're looking for: Python3 scripts executed from /tmp, /dev/shm, /run/user, or /var/tmp by non-root users. The Copy Fail PoC is a 732-byte Python script that always runs from temp directories. In production, Python from temp dirs is almost always suspicious.

# Hunt: Python execution from temp directories ausearch -m EXECVE -i 2>/dev/null | \ grep -E 'python.*(/tmp|/dev/shm|/run/user|/var/tmp)' # Hunt: Find the exact PoC file (732 bytes) find /tmp /dev/shm /run/user /var/tmp -name '*.py' -size 732c 2>/dev/null # Hunt: Any Python scripts in temp dirs (broader search) find /tmp /dev/shm /var/tmp -name '*.py' -mtime -7 -ls 2>/dev/null # Check process history: Python with child shell running as root ps auxef | grep -A5 python | grep -E '(root|uid=0)'

STEP 5 Check Kernel Module — Is algif_aead Still Loaded? TRIAGE

What you're checking: Whether the vulnerable module is still active (exploit path open) AND whether your mitigation is actually working. On RHEL-family distros, the module is built-in — lsmod won't show it even though it's active.

# Check if algif_aead is loaded as a module lsmod | grep algif_aead # IMPORTANT: On RHEL-family, module may be BUILT-IN (not in lsmod) # Check kernel config to know if it's built-in: grep CONFIG_CRYPTO_USER_API_AEAD /boot/config-$(uname -r) # If result = "=y" → BUILT-IN (modprobe blacklist will NOT work!) # If result = "=m" → LOADABLE MODULE (modprobe blacklist works) # Check if AF_ALG socket interface is accessible python3 -c "import socket; s=socket.socket(38,5); print('VULNERABLE: AF_ALG accessible')" 2>/dev/null || echo "MITIGATED" # On RHEL: check if grubby blacklist is applied cat /proc/cmdline | grep initcall_blacklist

STEP 6 Check Post-Exploitation — Persistence Artifacts POST-ROOT

What you're looking for: If exploitation succeeded, the attacker had root. They will have planted persistence within seconds. Check for new SSH keys, new SUID binaries, modified passwd/shadow, new cron entries, and new systemd services. The page-cache exploit is cleared by reboot — but persistence survives.

# 1. New SSH authorized_keys for root stat /root/.ssh/authorized_keys 2>/dev/null cat /root/.ssh/authorized_keys 2>/dev/null # check for unknown keys # 2. New SUID binaries created post-disclosure (Apr 29) find / -perm -4000 -newer /var/log/dpkg.log -ls 2>/dev/null find /tmp /dev/shm /usr/local/bin -perm -4000 -ls 2>/dev/null # 3. /etc/passwd or /etc/shadow modified unexpectedly stat /etc/passwd /etc/shadow # check Modify timestamp diff /etc/passwd /etc/passwd- # compare with backup # 4. New cron jobs for root crontab -l -u root 2>/dev/null ls -la /etc/cron.d/ /var/spool/cron/crontabs/ 2>/dev/null # 5. New systemd services find /etc/systemd/system/ -mtime -7 -name '*.service' -ls 2>/dev/null systemctl list-units --state=failed

STEP 7 eBPF Real-Time Monitor — Deploy on Suspected Systems REAL-TIME

When to use: If you suspect a system is under active attack but haven't found log evidence yet. Deploy this bpftrace one-liner for real-time alerting — it watches for AF_ALG socket creation by non-root and immediately prints attacker details.

# One-liner: real-time AF_ALG monitoring (run as root) bpftrace -e 'tracepoint:syscalls:sys_enter_socket /args->family==38 && uid>0/ { printf("⚠ COPY_FAIL: pid=%d uid=%d comm=%s\n",pid,uid,comm); }'

CHEAT SHEET SOC Analyst — Copy Fail Quick Reference

VAPT Says "Vulnerable" — What Do They Check?

• Kernel version between 4.13 and 6.18
• algif_aead module loaded or built-in
• AF_ALG socket family accessible
• No mitigation applied (blacklist/grubby)
• Patched kernel NOT installed
→ "System CAN be exploited"

SOC Says "Exploited" — What Do They Check?

• auditd: AF_ALG socket by non-root (a0=26)
• auditd: splice() by Python PID (syscall=275)
• auth.log: su entry with missing username
• auditd: uid≠0 → euid=0 without sudo ancestor
• Filesystem: new SSH keys, SUID bins, cron jobs
→ "System WAS exploited"

Log Source #1

/var/log/audit/audit.log

Log Source #2

/var/log/auth.log

Log Source #3

/var/log/secure (RHEL)

Log Source #4

dmesg / kernel ring buffer

IMPORTANT: If auditd was NOT running during the exploitation window (April 29 onwards), you have no syscall-level evidence. Fall back to auth.log analysis (Step 2), filesystem artifact checks (Step 6), and SIEM behavioral anomalies. Deploy auditd rules NOW to catch future attempts. Zero disk writes means traditional file integrity monitoring (AIDE, OSSEC, Tripwire) will not detect the initial exploit — only post-exploitation persistence.

⚠ BREAKING Module Blacklist DOES NOT WORK on RHEL-Family Distributions CloudLinux · 1 May 2026

CRITICAL UPDATE: CloudLinux discovered that the widely recommended modprobe blacklist workaround does NOT work on CloudLinux, AlmaLinux, Rocky Linux, or any RHEL-family distribution. The algif_aead module is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y), not as a loadable module. The blacklist commands execute without errors but leave the system completely unprotected — creating a false sense of security.

IMPACT ON YOUR IR PLAYBOOK

Phase 1 (Preparation) and Phase 3 (Containment) mitigation steps referencing modprobe -r algif_aead and blacklist algif_aead are ineffective on RHEL/CentOS/AlmaLinux/Rocky/CloudLinux/Oracle Linux. Replace with the grubby-based kernel command line approach below.

Correct mitigation for RHEL-family (requires reboot):

# RHEL-family: algif_aead is built-in, NOT a loadable module # modprobe blacklist has NO EFFECT — use grubby instead grubby --update-kernel=ALL \ --args="initcall_blacklist=algif_aead_init" reboot # Verify after reboot: cat /proc/cmdline | grep initcall_blacklist # Must show: initcall_blacklist=algif_aead_init

↗ CloudLinux Advisory ↗ Mitigation Details

ACTIVE EXPLOITATION Exploitation Attempts Observed in the Wild Multiple Sources · 1–2 May 2026

CloudLinux Imunify360 is actively detecting published IOCs for CVE-2026-31431 and using extended heuristics to identify and mitigate currently observed exploitation attempts. This confirms the vulnerability is being actively exploited in the wild — not just theoretical.

RedPacket Security's SSVC assessment has classified this as "active exploitation" — rated as an urgent, priority remediation item for all affected Linux kernel systems.

THREAT LEVEL ASSESSMENT

Exploitation Status: ACTIVE IN WILD

SSVC Decision: ACT IMMEDIATELY

Target Environments: Multi-tenant, CI/CD, hosting

PoC Availability: PUBLIC since 29 April

↗ RedPacket SSVC ↗ CloudLinux Imunify360

NEW DETECTION Wiz Discovers auth.log Post-Exploitation Detection Signal Wiz · 1 May 2026

Wiz security researchers published a detailed analysis identifying a new post-exploitation detection signal in /var/log/auth.log. When Copy Fail corrupts the /usr/bin/su binary in page-cache and the attacker executes it, the su PAM log entry is missing the invoking username — a field that is always present in legitimate su usage.

Normal su entry:

2026-05-01T09:11:16 su[1765]: (to root) alice on pts/1 ^^^^^ username present

Copy Fail exploitation su entry:

2026-05-01T09:14:19 su[1781]: (to root) on pts/1 ^ username MISSING

Hunt query for this signal:

# Search auth.log for su entries with missing username grep 'su\[.*\]: (to root) on' /var/log/auth.log # Splunk query index=linux_secure sourcetype=linux_secure | search "su" "to root" "on pts" NOT "alice" NOT "bob" | regex _raw="su\[\d+\]:\s+$to root$\s+on\s+pts"

ACTION REQUIRED

Add this as a new IOC to your detection rules. The missing-username su log entry is a high-confidence post-exploitation signal with very low false positive rate. Add to Phase 2 (Identification) and IOC table.

↗ Wiz Full Analysis

PATCHES Global Patch Rollout Status — Distro-by-Distro Multiple Sources · 1–2 May 2026

UbuntuPatched kernels available

✓ PATCHED

AlmaLinuxProduction repos — dnf clean metadata && dnf upgrade

✓ PATCHED

CloudLinuxKernel update + KernelCare livepatch (no reboot)

✓ PATCHED

DebianTracked in Debian Security Tracker

✓ TRACKED

Red Hat / RHELOfficial errata NOT yet released — AlmaLinux patched ahead of Red Hat

⏳ PENDING

Amazon LinuxTracked via ALAS — check yum update kernel

TRACKING

Mainline KernelCommit a664bf3d603d merged in 7.0-rc7

✓ FIXED

↗ AlmaLinux Patches ↗ Ubuntu Advisory ↗ CloudLinux / KernelCare ↗ Debian Tracker ↗ Amazon ALAS

CONFIRMED Kubernetes Container Escape — Page Cache Shared Across Boundaries Wiz / Xint / Orca · 30 Apr–1 May 2026

Multiple vendors confirmed that because the Linux page cache is shared across all processes on a host — including across container boundaries — CVE-2026-31431 functions as a container escape primitive. A compromised container can corrupt setuid binaries visible to other containers and the host kernel, escalating from container-level access to full host root.

CONTAINER RISK MATRIX

Kubernetes pods without seccomp → HOST ROOT

Docker containers → HOST ESCAPE

CI/CD runners (GitHub Actions, GitLab) → CRITICAL

Malicious PR + build runner → SUPPLY CHAIN

↗ Wiz Container Analysis ↗ Orca Security ↗ Xint K8s Escape (Part 2)

CONFIRMED Real-World Impact — WSL2, Broker Market, Independent Verification Multiple Sources · 29 Apr–2 May 2026

Microsoft WSL2 Affected

WSL2 (kernel 6.6.87.2-microsoft-standard-WSL2) confirmed vulnerable. Issue #40365 filed on GitHub. Any Windows developer running WSL2 is exposed.

Broker Market Valuation — $500K–$7M

Bugcrowd: "Zerodium's public price list paid up to $500K for a high-end Linux zero-day. Today's gray-market acquirers like Crowdfense run programs in the $10K–$7M range." An AI tool found this in about one hour. Source

Independent Verification — Solar Designer

Alexander Peslyak (Solar Designer), founder of the Openwall Project, independently confirmed the exploit works on Rocky Linux 9.7. oss-security

AI-Discovered Vulnerability

Discovered by Taeyang Lee (Theori). Xint Code AI tool found it in ~1 hour scanning Linux crypto subsystem. Reported 23 March, patch committed 1 April, CVE assigned 22 April, disclosed 29 April 2026. Xint Research

Additional confirmation: Alexander Peslyak (Solar Designer), founder of the Openwall Project, independently verified the exploit works on Rocky Linux 9.7.

↗ CybersecurityNews ↗ Xint Original Research ↗ oss-security Disclosure ↗ copy.fail

Tool / Platform	Available	What It Detects	Source
Sigma Rules	✓	AF_ALG socket + behavioral chain + LPE	thrandomv, kadir, insomnisec
Falco (Containers)	✓	Container AF_ALG socket with K8s context	thrandomv, cipherssecurity
auditd Rules	✓	socket(AF_ALG) + splice() + execve LPE	All 3 repos
Wazuh SIEM	✓	XML correlation rules (Level 10/14 alerts)	insomnisec
YARA Rules	✓	PoC file artifacts, ELF payloads, code patterns	Neo23x0, insomnisec, kadir
eBPF / bpftrace	✓	Real-time chain correlation (highest fidelity)	kadir
Page-Cache Diff	✓	Post-exploitation: memory vs disk comparison	kadir
Tenable / Nessus	✓	Vulnerability scanner plugins (VAPT)	Tenable
KQL (Sentinel)	✓	AF_ALG + LPE + metadata API queries	thrandomv + this playbook
EQL (Elastic)	✓	Sequence: SUID open → pipe2 → splice	thrandomv + this playbook

Tool / Platform

Available

What It Detects

Source

Sigma Rules

✓

AF_ALG socket + behavioral chain + LPE

thrandomv, kadir, insomnisec

Falco (Containers)

✓

Container AF_ALG socket with K8s context

thrandomv, cipherssecurity

auditd Rules

✓

socket(AF_ALG) + splice() + execve LPE

All 3 repos

Wazuh SIEM

✓

XML correlation rules (Level 10/14 alerts)

insomnisec

YARA Rules

✓

PoC file artifacts, ELF payloads, code patterns

Neo23x0, insomnisec, kadir

eBPF / bpftrace

✓

Real-time chain correlation (highest fidelity)

kadir

Page-Cache Diff

✓

Post-exploitation: memory vs disk comparison

kadir

Tenable / Nessus

✓

Vulnerability scanner plugins (VAPT)

Tenable

KQL (Sentinel)

✓

AF_ALG + LPE + metadata API queries

thrandomv + this playbook

EQL (Elastic)

✓

Sequence: SUID open → pipe2 → splice

thrandomv + this playbook

Type	Indicator	Description	Confidence	Action
Syscall	socket(AF_ALG=38, SOCK_SEQPACKET) by uid>0	AF_ALG socket creation by non-root. Step 1 of exploit chain. Near-zero legitimate non-root AF_ALG usage in production.	HIGH	Alert / Hunt
Syscall	splice(setuid_binary_fd → pipe → alg_socket) by uid>0	splice() chaining a setuid binary through pipe into AF_ALG socket. The exact exploit mechanism. auditd key: copy_fail_splice	HIGH	Alert / Isolate
Syscall	execve() where uid!=0 but euid=0, no sudo/su ancestor	Successful LPE — root process appeared without legitimate auth path. Hallmark of kernel LPE post-exploitation.	HIGH	Alert / Forensics
Syscall	open(O_RDONLY, /usr/bin/su\|/usr/bin/passwd) → splice() same PID within 5s	Setuid binary read immediately followed by splice() from same PID — exploit setup sequence.	HIGH	Alert / Hunt

Type

Indicator

Description

Confidence

Action

Syscall

socket(AF_ALG=38, SOCK_SEQPACKET) by uid>0

AF_ALG socket creation by non-root. Step 1 of exploit chain. Near-zero legitimate non-root AF_ALG usage in production.

HIGH

Alert / Hunt

Syscall

splice(setuid_binary_fd → pipe → alg_socket) by uid>0

splice() chaining a setuid binary through pipe into AF_ALG socket. The exact exploit mechanism. auditd key: copy_fail_splice

HIGH

Alert / Isolate

Syscall

execve() where uid!=0 but euid=0, no sudo/su ancestor

Successful LPE — root process appeared without legitimate auth path. Hallmark of kernel LPE post-exploitation.

HIGH

Alert / Forensics

Syscall

open(O_RDONLY, /usr/bin/su|/usr/bin/passwd) → splice() same PID within 5s

Setuid binary read immediately followed by splice() from same PID — exploit setup sequence.

HIGH

Alert / Hunt

Type	Indicator	Description	Confidence	Action
Process	python3 executing from /tmp/, /dev/shm/, /run/user/	Copy Fail PoC always runs from temp directories. Python interpreter + temp script path = high confidence.	HIGH	Alert / Block
Process	Python script exactly 732 bytes in size	Known PoC file size. Minor variants may differ slightly. Hunt: find / -name '*.py' -size 732c 2>/dev/null	MEDIUM	Hunt / Alert
Process	algif_aead in lsmod after mitigation was deployed	Module reappearing post-blacklist = attacker with root removed blacklist, or mitigation failed. Requires root to re-enable.	HIGH	Alert / Investigate
Process	bash/sh/zsh with ppid=python3 and uid=0	Post-exploitation root shell spawned from Python parent. Check: ps auxef \| grep 'uid=0' with Python as parent process.	HIGH	Alert / Isolate

Type

Indicator

Description

Confidence

Action

Process

python3 executing from /tmp/, /dev/shm/, /run/user/

Copy Fail PoC always runs from temp directories. Python interpreter + temp script path = high confidence.

HIGH

Alert / Block

Process

Python script exactly 732 bytes in size

Known PoC file size. Minor variants may differ slightly. Hunt: find / -name '*.py' -size 732c 2>/dev/null

MEDIUM

Hunt / Alert

Process

algif_aead in lsmod after mitigation was deployed

Module reappearing post-blacklist = attacker with root removed blacklist, or mitigation failed. Requires root to re-enable.

HIGH

Alert / Investigate

Process

bash/sh/zsh with ppid=python3 and uid=0

Post-exploitation root shell spawned from Python parent. Check: ps auxef | grep 'uid=0' with Python as parent process.

HIGH

Alert / Isolate

Type	Indicator	Description	Confidence	Action
File	New SUID binary in /usr/bin or /usr/local/bin after T=0	Attacker achieving root may add SUID shell: cp /bin/bash /tmp/.bash && chmod +s /tmp/.bash. Hunt: find / -perm -4000 -newer /var/log/dpkg.log	HIGH	Hunt / Remove
File	New entry in /root/.ssh/authorized_keys	Root SSH key implant for persistent backdoor access. Check mtime vs incident timeline.	HIGH	Hunt / Remove
File	/etc/passwd or /etc/shadow modified without expected system update	Attacker adding backdoor root account. auditctl -w /etc/passwd -p wa detects this.	HIGH	Alert / Investigate
File	New cron entry for root with unusual timing or command	Cron persistence post-root. Check /var/spool/cron/crontabs/root and /etc/cron.d/ modification timestamps.	HIGH	Hunt / Remove

Type

Indicator

Description

Confidence

Action

File

New SUID binary in /usr/bin or /usr/local/bin after T=0

Attacker achieving root may add SUID shell: cp /bin/bash /tmp/.bash && chmod +s /tmp/.bash. Hunt: find / -perm -4000 -newer /var/log/dpkg.log

HIGH

Hunt / Remove

File

New entry in /root/.ssh/authorized_keys

Root SSH key implant for persistent backdoor access. Check mtime vs incident timeline.

HIGH

Hunt / Remove

File

/etc/passwd or /etc/shadow modified without expected system update

Attacker adding backdoor root account. auditctl -w /etc/passwd -p wa detects this.

HIGH

Alert / Investigate

File

New cron entry for root with unusual timing or command

Cron persistence post-root. Check /var/spool/cron/crontabs/root and /etc/cron.d/ modification timestamps.

HIGH

Hunt / Remove

Type	Indicator	Description	Confidence	Action
UEBA	First-ever AF_ALG socket on this host in 90-day baseline	User/host has NEVER created AF_ALG socket in history — first occurrence is immediate high-confidence alert. AI UEBA detects this before root is achieved.	HIGH	AI Alert
UEBA	uid=0 process with no sudo/su ancestor, first time for this user	User has never had a root process without sudo/su in baseline. Sudden phantom root = LPE. UEBA flags the behavioral anomaly.	HIGH	AI Alert / Isolate
Network	HTTP GET to 169.254.169.254 (AWS/GCP/Azure metadata) within 60s of uid=0 transition	Post-LPE cloud credential theft. First-time metadata API access from this process context. AWS GuardDuty ML detects automatically.	HIGH	AI Alert / Block

Type

Indicator

Description

Confidence

Action

UEBA

First-ever AF_ALG socket on this host in 90-day baseline

User/host has NEVER created AF_ALG socket in history — first occurrence is immediate high-confidence alert. AI UEBA detects this before root is achieved.

HIGH

AI Alert

UEBA

uid=0 process with no sudo/su ancestor, first time for this user

User has never had a root process without sudo/su in baseline. Sudden phantom root = LPE. UEBA flags the behavioral anomaly.

HIGH

AI Alert / Isolate

Network

HTTP GET to 169.254.169.254 (AWS/GCP/Azure metadata) within 60s of uid=0 transition

Post-LPE cloud credential theft. First-time metadata API access from this process context. AWS GuardDuty ML detects automatically.

HIGH

AI Alert / Block

Tactic	Technique ID	Name	Copy Fail Context	Detection Signal
Privilege Escalation	T1068	Exploitation for Privilege Escalation ★ PRIMARY	authencesn AEAD logic flaw → splice chain → 4-byte page-cache overwrite → root. The complete exploit is this single technique.	auditd: socket(AF_ALG)+splice+execve sequence; uid=0 transition without sudo
Privilege Escalation	T1548.001	Setuid and Setgid	Exploit targets SUID binaries (/usr/bin/su, /usr/bin/passwd) as the overwrite target — standard setuid execution becomes root vector	Monitor read access to setuid binaries by non-root processes
Execution	T1059.006	Python	732-byte Python PoC executes the full exploit chain. Python used for AF_ALG socket creation, splice orchestration, and shellcode setup	ausearch -m EXECVE \| grep python \| grep -v '/usr/bin/python3 /usr'
Defense Evasion	T1027	Obfuscated Files/Info	Page-cache modification leaves ZERO disk artifacts — IDS/EDR file-write alerts completely silent. inotify does not trigger on page-cache-only writes	eBPF probe on page-cache dirty marking; behavioral anomaly detection only
Defense Evasion	T1562.001	Disable or Modify Tools	Attacker with root may remove /etc/modprobe.d/blacklist-copy-fail.conf to restore AF_ALG access for re-exploitation or leaving for others	auditctl -w /etc/modprobe.d/ -p wa; alert on deletion of blacklist file
Persistence	T1098.004	SSH Authorized Keys	Post-root: adding SSH key to /root/.ssh/authorized_keys for persistent no-password root access — most common first post-exploit action	auditctl -w /root/.ssh/ -p wa -k ssh_key_add
Persistence	T1543.003	Systemd Service	Post-root: attacker may install systemd service for persistent code execution on boot	Alert on new .service files in /etc/systemd/system/; systemctl list-units --state=failed
Credential Access	T1552.001	Credentials in Files	Post-root: reading /etc/shadow for all password hashes, app config files with cleartext passwords, private keys	Impossible to prevent post-root; detect via /etc/shadow access by unexpected process (auditd watch)
Impact	T1611	Escape to Host	In container environments: exploit runs inside container against host kernel → root on host → escape to host filesystem and process namespace	Container runtime security (Falco); seccomp block on AF_ALG socket; K8s admission policies

Tactic

Technique ID

Name

Copy Fail Context

Detection Signal

Privilege Escalation

T1068

Exploitation for Privilege Escalation ★ PRIMARY

authencesn AEAD logic flaw → splice chain → 4-byte page-cache overwrite → root. The complete exploit is this single technique.

auditd: socket(AF_ALG)+splice+execve sequence; uid=0 transition without sudo

Privilege Escalation

T1548.001

Setuid and Setgid

Exploit targets SUID binaries (/usr/bin/su, /usr/bin/passwd) as the overwrite target — standard setuid execution becomes root vector

Monitor read access to setuid binaries by non-root processes

Execution

T1059.006

Python

732-byte Python PoC executes the full exploit chain. Python used for AF_ALG socket creation, splice orchestration, and shellcode setup

ausearch -m EXECVE | grep python | grep -v '/usr/bin/python3 /usr'

Defense Evasion

T1027

Obfuscated Files/Info

Page-cache modification leaves ZERO disk artifacts — IDS/EDR file-write alerts completely silent. inotify does not trigger on page-cache-only writes

eBPF probe on page-cache dirty marking; behavioral anomaly detection only

Defense Evasion

T1562.001

Disable or Modify Tools

Attacker with root may remove /etc/modprobe.d/blacklist-copy-fail.conf to restore AF_ALG access for re-exploitation or leaving for others

auditctl -w /etc/modprobe.d/ -p wa; alert on deletion of blacklist file

Persistence

T1098.004

SSH Authorized Keys

Post-root: adding SSH key to /root/.ssh/authorized_keys for persistent no-password root access — most common first post-exploit action

auditctl -w /root/.ssh/ -p wa -k ssh_key_add

Persistence

T1543.003

Systemd Service

Post-root: attacker may install systemd service for persistent code execution on boot

Alert on new .service files in /etc/systemd/system/; systemctl list-units --state=failed

Credential Access

T1552.001

Credentials in Files

Post-root: reading /etc/shadow for all password hashes, app config files with cleartext passwords, private keys

Impossible to prevent post-root; detect via /etc/shadow access by unexpected process (auditd watch)

Impact

T1611

Escape to Host

In container environments: exploit runs inside container against host kernel → root on host → escape to host filesystem and process namespace

Container runtime security (Falco); seccomp block on AF_ALG socket; K8s admission policies

Use Case	Kill Chain Stage	MITRE	Specificity	Best Platform
UC-CF-001	Pre-exploitation / Step 1	T1068	Copy Fail SPECIFIC — AF_ALG socket	auditd + Splunk/Sentinel
UC-CF-002	Active exploitation / Steps 3–4	T1068	Copy Fail SPECIFIC — syscall chain	Splunk transaction / Elastic EQL
UC-CF-003	Setup / Steps 1–2 (pre-AF_ALG)	T1068 + T1548.001	Copy Fail SPECIFIC — pipe2+splice	Elastic EQL sequence / auditbeat
UC-CF-004	Exploitation success / Step 6	T1068 + T1548.001	Generic LPE (all kernel LPE) — auid narrows	auditd + all SIEMs
UC-CF-005	Defense Evasion (post-root)	T1562.001	Copy Fail SPECIFIC — algif_aead module	osquery + auditd FIM
UC-CF-006	Post-exploitation / Cred Access	T1552.005	Generic cloud post-LPE (high value)	Sentinel + AWS GuardDuty ML
UC-CF-007	Post-exploitation / Persistence	T1098.004 + T1548.001	Generic post-root (FIM-based)	auditd FIM + Wazuh
UC-CF-008	Container → Host Escape	T1611 + T1068	Copy Fail + container context	Falco + K8s audit log

Platform	What It Can Do for Copy Fail	Pre-Built Rule?	What You Need
Splunk ES 8.5	RBA scores aggregate AF_ALG + splice + LPE events into single notable. AI Assistant summarizes findings for L1 analysts. Detection Studio maps coverage gaps against ATT&CK T1068.	No — deploy SPL from this playbook	auditd → Splunk via TA-linux-auditd
Microsoft Sentinel	UEBA baselines privilege patterns per user. Flags uid→euid=0 without auth ancestor as behavioral anomaly. KQL hunting queries in this playbook work directly.	No — deploy KQL from this playbook	MDE Linux agent or CEF auditd connector
Elastic Security	EQL sequences detect AF_ALG → splice → su chain with PID correlation. Elastic AI Assistant explains alert context. Auditbeat feeds syscall events directly.	No — deploy EQL from this playbook	auditbeat with auditd module
CrowdStrike Falcon	Falcon Linux sensor captures syscall telemetry. Behavioral AI can flag unusual process chains (python → AF_ALG → root). Charlotte AI generates hunting queries from natural language.	Behavioral detection possible — no CVE-specific rule	Falcon Linux sensor deployed
SentinelOne	Singularity agent monitors Linux process lifecycle. Purple AI generates hunting queries in natural language. CVE tracked in vulnerability database.	Behavioral detection possible — no CVE-specific rule	Singularity Linux agent
AWS GuardDuty	ML automatically flags first-time metadata API (169.254.169.254) access by unusual processes — catches post-LPE credential theft without any custom rules.	Yes — built-in ML findings	GuardDuty enabled on EC2/EKS
Tenable / Nessus	Scanner plugins released — identifies unpatched kernel versions across fleet. Classified as Vulnerability Watch item. Does NOT detect exploitation — only vulnerability presence.	Yes — scanner plugins available	Nessus/Tenable.io scan
Wiz	Cloud workload scanning identifies vulnerable kernel versions. Published auth.log detection signal. Pre-built queries in Wiz Threat Intel Center for customer environments.	Yes — advisory + queries available	Wiz agent on cloud workloads
Falco / Sysdig	Runtime syscall monitoring with container context (pod name, namespace, image). Detects AF_ALG socket creation inside containers. Best for Kubernetes environments.	No — deploy Falco rule from this playbook	Falco DaemonSet on K8s
Wazuh	Open-source SIEM with auditd decoder. Correlation rules from this playbook (Level 10/14) bridge auditd events into Wazuh alerts. Free alternative to commercial SIEMs.	No — deploy XML rules from this playbook	Wazuh agent + auditd rules

Platform

What It Can Do for Copy Fail

Pre-Built Rule?

What You Need

Splunk ES 8.5

RBA scores aggregate AF_ALG + splice + LPE events into single notable. AI Assistant summarizes findings for L1 analysts. Detection Studio maps coverage gaps against ATT&CK T1068.

No — deploy SPL from this playbook

auditd → Splunk via TA-linux-auditd

Microsoft Sentinel

UEBA baselines privilege patterns per user. Flags uid→euid=0 without auth ancestor as behavioral anomaly. KQL hunting queries in this playbook work directly.

No — deploy KQL from this playbook

MDE Linux agent or CEF auditd connector

Elastic Security

EQL sequences detect AF_ALG → splice → su chain with PID correlation. Elastic AI Assistant explains alert context. Auditbeat feeds syscall events directly.

No — deploy EQL from this playbook

auditbeat with auditd module

CrowdStrike Falcon

Falcon Linux sensor captures syscall telemetry. Behavioral AI can flag unusual process chains (python → AF_ALG → root). Charlotte AI generates hunting queries from natural language.

Behavioral detection possible — no CVE-specific rule

Falcon Linux sensor deployed

SentinelOne

Singularity agent monitors Linux process lifecycle. Purple AI generates hunting queries in natural language. CVE tracked in vulnerability database.

Behavioral detection possible — no CVE-specific rule

Singularity Linux agent

AWS GuardDuty

ML automatically flags first-time metadata API (169.254.169.254) access by unusual processes — catches post-LPE credential theft without any custom rules.

Yes — built-in ML findings

GuardDuty enabled on EC2/EKS

Tenable / Nessus

Scanner plugins released — identifies unpatched kernel versions across fleet. Classified as Vulnerability Watch item. Does NOT detect exploitation — only vulnerability presence.

Yes — scanner plugins available

Nessus/Tenable.io scan

Wiz

Cloud workload scanning identifies vulnerable kernel versions. Published auth.log detection signal. Pre-built queries in Wiz Threat Intel Center for customer environments.

Yes — advisory + queries available

Wiz agent on cloud workloads

Falco / Sysdig

Runtime syscall monitoring with container context (pod name, namespace, image). Detects AF_ALG socket creation inside containers. Best for Kubernetes environments.

No — deploy Falco rule from this playbook

Falco DaemonSet on K8s

Wazuh

Open-source SIEM with auditd decoder. Correlation rules from this playbook (Level 10/14) bridge auditd events into Wazuh alerts. Free alternative to commercial SIEMs.

No — deploy XML rules from this playbook

Wazuh agent + auditd rules