SCTPhantom (CVE-2026-64564) — container-to-host escape via SCTP ASCONF

Ankit Mehta@Secvyn

•updated Aug 8, 2026•7•0•4

This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.