Sigma rule: Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator

Rule

Title

Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator

Status

experimental

Level

high

Author

Gene Kazimiarovich

Date

2026-05-09

File

rules-emerging-threats/2026/Exploits/CVE-2026-31431/proc_creation_lnx_exploit_cve_2026_31431_copyfail.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.

On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.

Log source

product

linux

category

process_creation

Detection

selection_kmod:
    Image|endswith: '/kmod'
    CommandLine|contains|all:
        - 'modprobe'
        - 'crypto-authencesn('
selection_modprobe:
    Image|endswith: '/modprobe'
    CommandLine|contains: 'crypto-authencesn('
condition: 1 of selection_*

False positives (as the rule lists them)

• Legitimate manual loading of the authencesn module by administrators for kernel crypto benchmarking or IPsec configuration (near-zero in production)

Tags

• attack.privilege-escalation
• attack.t1068
• attack.persistence
• attack.t1547.006
• detection.emerging-threats
• cve.2026-31431

CVEs this rule names

• CVE-2026-31431

MITRE ATT&CK ids this rule names

• T1068
• T1547.006

References

• https://www.linkedin.com/posts/stamatis-chatzimangou_copyfail-kql-activity-7455582422215114752-S4RW/
• https://www.splunk.com/en_us/blog/security/detecting-copy-fail-cve-2026-31431-phenomenal-power-itty-bitty-script.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-31431
• https://man7.org/linux/man-pages/man8/modprobe.8.html
• https://www.kernel.org/doc/html/latest/crypto/userspace-if.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Exploits/CVE-2026-31431/proc_creation_lnx_exploit_cve_2026_31431_copyfail.yml