Dirty Family LPE CVE-2026-31431 (CopyFail / Dirty Frag / Fragnesia)

chiki briki@ekkor13

•updated Jul 10, 2026•4•0•25

This rule detects instances of the 'su' utility being executed in a manner inconsistent with normal system administration patterns. By filtering out common, expected parent processes (such as login shells, terminal multiplexers, or established system services) and identifying 'su' command-line execution or shell commands attempting to invoke it, the rule flags potentially malicious privilege escalation attempts, such as those exploiting local vulnerabilities.