Suspicious Python AF_ALG Cryptography (CVE-2026-31431)

Elgonad .@elgonad

•updated Apr 30, 2026•2•0•419

This rule detects the execution of Python interpreters on Linux systems where the command line contains a specific AF_ALG cryptography template. This template is associated with a known vulnerability (CVE-2026-31431) and is considered highly suspicious due to its rarity in legitimate command lines. The detection targets the 'authencesn(hmac(sha256),cbc(aes))' string within the Python command line arguments.