Detects dirtyfrag, a local privilege escalation exploit for Linux.

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting the Dirty COW vulnerability to escalate from unprivileged user accounts to root on Linux systems within Azure Sentinel. Proactively hunting for this behavior is essential because a successful local privilege escalation can grant attackers full system control, enabling lateral movement and data exfiltration before broader network-based detections trigger.

YARA Rule

rule EXPL_HKTL_LNX_DirtyFragLPE_May26 {
   meta:
      description = "Detects dirtyfrag, a local privilege escalation exploit for Linux."
      author = "Pezier Pierre-Henri (Nextron Systems)"
      date = "2026-05-07"
      score = 80
      hash = "c35594d42f7a5d5d2895164147ee1bc62bb8e294c8468093b7d6fcaab0b174c8"
      reference = "https://github.com/V4bel/dirtyfrag/tree/master"
      id = "7548b4c6-6b0f-5c05-acab-26dceac109ac"
   strings:
      // Indicators of exploitation attempts
      $x1 = "gained CAP_NET_RAW within netn" ascii
      $x2 = "DIRTYFRAG_VERBOSE" ascii

      $s1 = { 15 7C 4A 7F B9 79 37 9E }  // fc_splitmix64
      $s2 = "/proc/self/setgroups" ascii fullword
      $s3 = "pcbc(fcrypt)" ascii fullword
      $s4 = { 17 bb c7 f3 3f 36 ba 71 8e 97 65 60 69 b6 f6 e6 }
   condition:
      filesize < 100KB
      and uint32be(0) == 0x7f454c46
      and (
         1 of ($x*)
         or 3 of ($s*)
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the DirtyPipe (CVE-2022-40917) detection rule in an enterprise Linux environment, along with recommended filters or exclusions:

Scenario: Automated Log Rotation via logrotate
- Context: The system’s scheduled logrotate daemon frequently rotates large log files (e.g., /var/log/syslog, /var/log/nginx/access.log) by truncating and rewriting them. This process often involves writing to open file descriptors in a manner that mimics the DirtyPipe write-overflow behavior, triggering the rule when the service runs during peak hours.
- Filter/Exclusion: Exclude processes where process_name equals logrotate AND command_line contains --state or --output. Alternatively, create an exclusion for file paths matching /var/log/* if the detection logic relies heavily on log directory activity.
Scenario: Database Backup Jobs using pg_dump or mysqldump
- Context: Scheduled nightly backup jobs for PostgreSQL (pg_dump) or MySQL (mysqldump) often write massive data streams to temporary files before archiving them to S3 or NFS. These tools utilize high-throughput file I/O that can trigger the DirtyPipe signature, especially when writing to shared storage volumes where multiple processes access the same pipe simultaneously.
- Filter/Exclusion: Add a filter for process_name in (pg_dump, mysqldump, tar) AND user equals postgres or mysql. Additionally, exclude events occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) where these backups are known to run.
Scenario: CI/CD Pipeline Artifact Generation by Jenkins/GitLab Runner *