Linux Non-Root Process Interacting with Root Process or Specific Indicators

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•7

This rule detects two scenarios on Linux systems: 1. A non-root process interacting with a root process (e.g., cross-process communication where the source is non-root and the target is root). 2. Any process (excluding root) exhibiting indicators related to 'AF_ALG' or 'splice', or mentioning 'CVE-2026-31431' in its name or description. These indicators are often associated with privilege escalation attempts or kernel exploits.