Linux.Detection.CopyFail.Exploitation

name: Linux.Detection.CopyFail.Exploitation
description: |
  Hunts for signs of successful Copy Fail (CVE-2026-31431) exploitation.
  Targets kernel log messages regarding 'null argv' shells and suspicious 'PF_ALG' registration.

author: Yaniv Goldman
type: CLIENT

required_permissions:
  - EXECVE
  - FILESYSTEM_READ

parameters:
  - name: ExploitRegex
    default: "launched .+ with NULL argv"
  - name: ProtocolRegex
    default: "Registered PF_ALG protocol family"
  - name: Lookback
    default: "48 hours ago"
  - name: SyslogPath
    default: "/var/log/kern.log"

sources:
  - name: Journal
    description: "Results parsed from journalctl."
    query: |
      LET RawLogs = SELECT Stdout FROM execve(argv=['journalctl', '-k', '--since', Lookback])
      
      SELECT 
         Timestamp,
         Hostname,
         Message
      FROM parse_records_with_regex(
         accessor="data",
         file=RawLogs.Stdout,
         regex='(?P<Timestamp>\\S+\\s+\\d+\\s+\\d+:\\d+:\\d+)\\s+(?P<Hostname>\\S+)\\s+kernel:\\s+(?P<Message>.*)')
      WHERE Message =~ ExploitRegex 
         OR Message =~ ProtocolRegex

  - name: KernelLogs
    query: |
      -- Parsing standard kernel logs for exploit signatures
      SELECT Line, SyslogPath AS FullPath
      FROM parse_lines(filename=SyslogPath)
      WHERE Line =~ ExploitRegex OR Line =~ ProtocolRegex