Python AF_ALG Socket Creation with Vulnerable Crypto Template

Elgonad .@elgonad

•updated Apr 30, 2026•4•0•298

Detects Python processes creating AF_ALG sockets with the 'authencesn' crypto template, which could indicate exploitation of CVE-2026-31431. This rule specifically looks for Python interpreter executions on Linux systems where the command line contains both 'socket.socket(38' (representing AF_ALG family) and 'authencesn'.