SIGNATURE_BASE_EXPL_LNX_Dirtyfrag_Forensicartefacts_May26

rule SIGNATURE_BASE_EXPL_LNX_Dirtyfrag_Forensicartefacts_May26 : FILE
{
	meta:
		description = "Detects DirtyFrag exploit code POC usage in Linux environments"
		author = "Florian Roth"
		id = "bda5e087-8eb7-55bd-a5ff-0eef91d63bcf"
		date = "2026-05-08"
		modified = "2026-05-15"
		reference = "https://github.com/V4bel/dirtyfrag/tree/master"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnx_dirtyfrag.yar#L62-L77"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "3790a19c180d1fcdcaf91c13b858d63adf126e9282999ccd424a0e6b9ae0e094"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$xa1 = "/V4bel/dirtyfrag.git" ascii
		$xa2 = "static const uint8_t shell_elf[PAYLOAD_LEN] = {" ascii
		$xa3 = "/usr/bin/su page-cache patched (entry 0x%x = shellcode)" ascii

	condition:
		filesize < 800KB and 1 of ( $xa* )
}