CVE-2026-46331 PACKET_EDIT_MEME pedit COW Exploit Binary on Disk
This rule detects the creation, modification, or renaming of files that are explicitly named after known security research projects, proof-of-concept exploits, or common testing artifacts (e.g., pedit_cow_demo, packet_edit_meme). These files are often associated with exploit development or security testing activities.
Microsoft Sentinel (KQL)
