libpwn Local RCE Harness Execution and Proof File Creation (CVE-2026-55200)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects the presence of specific file names, paths, or command line arguments associated with a known penetration testing or exploit harness tool (libpwn). These artifacts are indicative of potential security testing or exploit activity on the host.