Skip to content

Instantly share code, notes, and snippets.

@dglauche

dglauche/gist:7b243b30f03c545286a82675d69bff41

Created May 1, 2026 20:54
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save dglauche/7b243b30f03c545286a82675d69bff41 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save dglauche/7b243b30f03c545286a82675d69bff41 to your computer and use it in GitHub Desktop.
Download ZIP
SPL Query for CVE-2026-31431 / CopyFail (https://github.com/badsectorlabs/copyfail-go)
Raw
gistfile1.txt
index=linux* sourcetype IN ("auditd", "linux:auditd:enriched") TERM(SYSCALL) type=SYSCALL ((syscall=41 uid!="0" uid!="4294967295") OR (syscall=59 uid!="0" euid="0" exe="/usr/bin/su"))
| bin _time span=1m
| stats
values(exe) AS exe
values(ppid) AS ppid
values(uid) AS uids
values(UID) AS user
count(eval(SYSCALL="socket")) AS af_alg_socket_count,
count(eval(SYSCALL="execve")) AS priv_execve_count
by _time, host, pid
| where af_alg_socket_count >= 10 OR priv_execve_count > 0
| eventstats values(ppid) as ppids by _time, host
| where mvfind(ppids, pid) >= 0
| fields _time, host, user, exe, pid, uids
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment