RxRPC Key Addition via add_key (Dirty Frag LPE)
Detects the addition of malicious RxRPC v1 tokens to the process keyring. This behavior is indicative of the RxRPC variant of the Dirty Frag Linux local privilege escalation exploit. The exploit uses the add_key syscall to plant a session key used for in-place pcbc(fcrypt) decryption, targeting privileged files like /etc/passwd.
Cortex XDR
