← Back to SOC feed Coverage →

Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux.

yara CRITICAL signature-base
exploitflorian-roth
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-08-03T23:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting the Dirty COW vulnerability to execute specific shellcode that facilitates local privilege escalation on Linux systems within Azure Sentinel. Proactive hunting is essential because this critical-severity threat allows attackers to gain root access from a compromised user context, potentially enabling lateral movement and persistent control over sensitive infrastructure.

YARA Rule

rule EXPL_HKTL_LNX_DirtyFragShellcode_May26 {
   meta:
      description = "Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux."
      reference = "https://github.com/V4bel/dirtyfrag/tree/master"
      author = "Pezier Pierre-Henri (Nextron Systems)"
      date = "2026-05-07"
      score = 80
      hash = "a02ea2ba8108a9b7a997faa8808cfc55bb69af54e69178fa5aa1785681cf0ced"
      id = "c156da87-c029-5084-9cd3-a233fefdaf25"
   strings:
      $op1 = {
         31 ff     // xor     edi, edi
         31 f6     // xor     esi, esi
         31 c0     // xor     eax, eax
         b0 6a     // mov     al, 6Ah ; 'j'
         0f 05     // syscall; LINUX - sys_setgid
         b0 69     // mov     al, 69h ; 'i'
         0f 05     // syscall; LINUX - sys_setuid
         b0 74     // mov     al, 74h ; 't'
         0f 05     // syscall; LINUX - sys_setgroups
         6a 00     // push    0
         48 [6]    // lea     rax, aTermXterm; "TERM=xterm"
         50        // push    rax
         48 89 e2  // mov     rdx, rsp
         48 [6]    // lea     rdi, aBinSh; "/bin/sh"
         31 f6     // xor     esi, esi
         6a 3b     // push    3Bh ; ';'
         58        // pop     rax
         0f 05     // syscall; LINUX - sys_execve
      }
   condition:
      $op1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios and corresponding filters/exclusions for the “DirtyCov/Shellcode in dirtyfrag” detection rule:

Original source: https://github.com/Neo23x0/signature-base/blob/main/yara/expl_lnx_dirtyfrag.yar