Linux Kernel Privilege Escalation Vulnerability (Dirty Frag) PoC
Detects the execution of the public Proof-of-Concept for the "Dirty Frag" Linux Kernel Privilege Escalation vulnerability. It monitors for the specific command-line flags '--force-esp' and '--force-rxrpc', as well as the execution of /bin/sh or /bin/bash with the TERM=xterm environment variable, which is indicative of the PoC's payload.
Microsoft Sentinel (KQL)
