ExifTool Spawning setfile With Suspicious Argument Pattern
Detects the exploitation primitive of CVE-2026-3102 at the post-injection execution layer. The exploit succeeds when exiftool constructs a /usr/bin/setfile command line containing attacker-injected shell metacharacters (single quotes for command injection, backticks or $() for command substitution, semicolons for command chaining). Detecting setfile invocations spawned by exiftool with these characters in arguments is the smoking-gun signal. Even future variants of this vulnerability class (or related n-day exploits in the same family) would produce this same parent/child + metacharacter pattern.
CQL
