Loading story…
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as Dirty Frag, tied to CVE-2026-43284 and CVE-2026-43500. The detection maps to MITRE ATT&CK technique T1548.001 for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root.
The analytic looks for a distinctive exploit chain in Linux auditd telemetry: a burst of splice() or vmsplice() syscalls from a process launched from a user-writable path, followed within five minutes by execution of a setuid binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux auditd data with audit rule keys for splice_user and process_creation; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk Research published a detection analytic for identifying exploitation of the Linux kernel local privilege escalation issue Dirty Frag, associated with CVE-2026-43284 and CVE-2026-43500. The write-up describes detecting a syscall spray followed by execution of a setuid binary and notes calibration against the public V4bel proof of concept.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released a Linux anomaly detection analytic for suspicious staging of alternate system files associated with **CVE-2025-32463** (`chwoot`), a local privilege-escalation technique that abuses fake root directories and spoofed configuration files. The analytic looks for creation of sensitive files such as `passwd`, `shadow`, `sudoers`, `nsswitch.conf`, and `libnss` libraries outside expected locations, aiming to catch attempts to influence how privileged processes including `sudo` resolve name services. The detection uses Endpoint telemetry mapped to the Splunk CIM Filesystem data model and is designed to identify filesystem activity outside normal paths such as `/etc` and `/var/lib/docker`. Splunk said the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts because legitimate development, testing, and container-related activity may trigger false positives. Separately, MITRE ATT&CK documents **Aoqin Dragon** (`G1007`) as a suspected Chinese cyber-espionage group targeting government, education, and telecommunications organizations in the Asia-Pacific region, though the reference does not tie the group directly to the `chwoot` detection.
Aug 12, 2026
Linux defenders are being urged to detect local privilege escalation through behavioral correlations rather than signatures for individual CVEs. Elastic’s framework combines endpoint and Auditd telemetry to identify unprivileged processes that reach UID 0 after executing from writable paths, invoking suspicious SUID/SGID binaries, manipulating user namespaces with `unshare`, abusing trusted helpers, or accessing privileged data. Testing covered 11 public proof-of-concept exploits and SUID misconfigurations, including page-cache corruption, D-Bus, namespace, and file-descriptor-theft techniques; the researchers caution that custom evasion-focused exploits may bypass coverage. The guidance follows active risk from page-cache vulnerabilities including **Copy Fail** (`CVE-2026-31431`), which is reported exploited in the wild and listed in CISA’s KEV catalog, and DirtyFrag. These flaws can modify cached readable files—including SUID binaries, `/usr/bin/su`, or `/etc/passwd`—to gain root, with suspicious socket, `splice()` and namespace activity providing detection opportunities. Defenders should patch affected kernels, consider restricting unprivileged user namespaces and relevant kernel modules after compatibility testing, and evict page cache after mitigation. They should also monitor `/proc/sys/fs/binfmt_misc` for new or changed handlers and attacker-controlled interpreters, as the `binfmt_misc` credentials flag can redirect a legitimate SUID program to a malicious handler that inherits root privileges without the handler carrying a SUID bit.
Sep 11, 2026
Security content from Elastic and Splunk highlights two Linux behaviors that defenders should monitor closely: unauthorized privilege escalation through `setuid` execution and deletion of web server access logs. Splunk published an anomaly detection for Linux `auditd` that flags `execve` syscall 59 events where a non-root user gains effective UID 0 without a matching successful PAM authentication event in the same audit session, a pattern associated with privilege escalation and mapped to MITRE ATT&CK `T1068`; the rule also references `CVE-2026-46331` and notes that some scheduled tasks can produce false positives. Elastic separately documented a prebuilt rule for detecting deleted web server access logs, while ThreatBear provided tuning guidance showing how legitimate activity on Mitel MiCollab systems can create noisy process trees and trigger alerts such as suspicious Java child processes and logfile deletion detections. The combined guidance underscores that Linux monitoring programs should pair coverage for high-risk behaviors with environment-specific exceptions so defenders can preserve visibility into real attacks without overwhelming analysts with benign alerts.
Jul 31, 2026