Suspicious Python AF_ALG Cryptography (Copy Fail / CVE-2026-31431)

nomit vyas@xoxo

•updated Apr 30, 2026•11•0•506

This rule detects the execution of Python processes on Linux systems that include a specific cryptographic template string in their command line. This string, "authencesn(hmac(sha256),cbc(aes))", is indicative of a Proof-of-Concept (PoC) exploit related to CVE-2026-31431, also known as 'Copy Fail'. The detection targets Python binaries (python, python3, or versioned python3.x) and aims to identify attempts to leverage this vulnerability for suspicious cryptographic operations.