ITScape PoC Command Execution
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.
Microsoft Sentinel (KQL)
