libpwn Exploit Harness Binaries and exploitarium RCE Staging Files on Disk

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.