Unprivileged User Namespace Creation (Dirty Frag LPE Precursor)

Thiru N@Iamthiru

•updated May 8, 2026•10•0•297

This rule detects the execution of the `unshare` utility with parameters to create a new user namespace (`-U` or `--user`). This activity is a known precursor for the Dirty Frag Linux kernel Local Privilege Escalation (LPE) exploit, where an unprivileged user can gain elevated privileges. The rule specifically targets Linux process execution events.