Suspicious Process Command Line - AF_ALG Socket

Danny Y@zendannyy

•updated May 1, 2026•10•0•670

This rule detects processes with a command line containing 'socket' and various cryptographic keywords (copy.fail, algif_aead, authencesn, hmac.*sha256.*cbc.*aes). This combination can indicate suspicious related to Copy Fail CVE-2026-3143