Linux VDSO Hijack Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.