Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall. AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431 to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD splice path that corrupts the page cache of SUID binaries. Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN daemons using non-default kernel offload configurations.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Definition
Required auditd configuration: auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect
detection:
selection:
type: 'SYSCALL'
SYSCALL: 'socket'
a0: 26 # auditd SYSCALL args are commonly logged in hex; 0x26 == 38 (AF_ALG)
filter_main_legitimate:
exe|endswith:
- '/cryptsetup'
- '/kcapi-speed'
- '/kcapi-enc'
- '/kcapi-dgst'
- '/charon'
- '/charon-systemd'
condition: selection and not 1 of filter_main_*Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
Libkcapi userspace tools for kernel crypto API benchmarking
StrongSwan IKE daemon with kernel-libipsec plugin
Other