Phoenix Studio

Convert indexed Sigma rules into analyst-ready detections.

This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.

Browse Rules Explore Ecosystem

Indexed Rules

3,779

Ready to search

Backends

Loaded from pysigma-node

pySigma Versions

Newest: 2.0.1

Translation Workspace

Shape the rule before it leaves Phoenix

Tune Translation

Active Rule

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

pySigma version

Backends follow their supported pySigma version. Select 1.5.1 for Elasticsearch, Kusto, and other 1.x plugins.

Backend

Format

Target Profile

Splunk

Splunk through pysigma-backend-splunk.

Format Mode

Default

Default pySigma output mode for this backend.

Conversion Output

Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator

Using Splunk · Default · pySigma 2.0.1

Translation controls

Adjust the rule on the left, then regenerate when you want a fresh backend-native query.

BackendSplunkFormatDefaultVersion2.0.1

title: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator
id: 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
status: experimental
description: |
    Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
    AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
    to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
    splice path that corrupts the page cache of SUID binaries.
    Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
    daemons using non-default kernel offload configurations.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
    - https://man7.org/linux/man-pages/man2/socket.2.html
    - https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
    - https://xint.io/blog/copy-fail-linux-distributions
    - https://github.com/theori-io/copy-fail-CVE-2026-31431
    - https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
author: Gene Kazimiarovich
date: 2026-04-30
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats
    - cve.2026-31431
logsource:
    product: linux
    service: auditd
    definition: |
        Required auditd configuration:
        auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'socket'
        a0: 26  # auditd SYSCALL args are commonly logged in hex; 0x26 == 38 (AF_ALG)
    filter_main_legitimate:
        exe|endswith:
            - '/cryptsetup'
            - '/kcapi-speed'
            - '/kcapi-enc'
            - '/kcapi-dgst'
            - '/charon'
            - '/charon-systemd'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
    - Libkcapi userspace tools for kernel crypto API benchmarking
    - StrongSwan IKE daemon with kernel-libipsec plugin
level: high

CLI command

Sigma CLI 4.0.0 · Install matching versions, then run from the Phoenix project directory.

python -m pip install 'sigma-cli==4.0.0' 'pysigma==2.0.1' 'pysigma-backend-splunk==3.0.0'
sigma convert --without-pipeline -t splunk -f default 'sigma/rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml'