Execution of PoC binaries named DirtyAH6, TUNderflow, PPPoEject, or DiagSpill

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•0

This rule detects the execution of specific suspicious filenames (dirtyah6, tunderflow, pppoeject, diagspill) when they are launched from common staging or temporary directories such as /tmp, /home, or /root, while excluding known build environments, package management directories, and common development workspaces.