Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
2
2
1
Platforms
3
Products / Services
2
2
MITRE Techniques
3
1
CVEs
71
71
64
58
49
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.