YARA Detection Rule: EXPL_LNX_Copy_Fail_Artefacts_CVE_2026_31431_Apr26
Repository: Neo23x0/signature-base
Detects: Detects forensic artifacts related to public Copy Fail (CVE-2026-31431) exploit PoCs, including known tiny ELF shell payloads, Python exploit code fragments, AF_ALG/authencesn/splice usage patterns, public PoC URLs, and other indicators observed in online proof-of-concept material.
Author: Florian Roth
Reference: https://copy.fail

Pattern signatures:
// Network indicators (e.g. in bash history, logs, etc.)
      $xn1 = "curl https://copy.fail/exp" ascii

      // Code fragments from public PoCs
      $xs1 = "| python3 && su"
      $xs2 = "g.open(\"/usr/bin/su\",0);i=0;"
      $xs3 = "[-] page-cache mutation failed"
      $xs4 = "[+] /etc/passwd page cache mutated"
      $xs5 = "bind(AF_ALG: authencesn(hmac(sha256),cbc(aes)))"
      $xs6 = "/tmp/.cve_test"

      // Indicator Combo
      $sa1 = "authencesn(hmac(sha256),cbc(aes))" ascii

      $sb1 = { 08 00 01 00 00 00 00 10 }
      $sb2 = "[PII_REDACTED]" ascii

      // Base64 encoded payloads
      $xe1 = "authencesn(hmac(sha256),cbc(aes))" base64

      // Tiny x86-64 ELF shell payload: setuid(0) -> execve("/bin/sh") -> exit(0)
      $xc1 = { 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 02 00 3e 00 01 00 00 00 78 00 40 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 38 00 01 00 00 00 00 00 00 00 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 0

Detection condition:
1 of ($x*)
      or ($sa1 and 1 of ($sb*))

Full rule:
rule EXPL_LNX_Copy_Fail_Artefacts_CVE_2026_31431_Apr26 {
   meta:
      description = "Detects forensic artifacts related to public Copy Fail (CVE-2026-31431) exploit PoCs, including known tiny ELF shell payloads, Python exploit code fragments, AF_ALG/authencesn/splice usage patterns, public PoC URLs, and other indicators observed in online proof-of-concept material."
      author = "Florian Roth"
      reference = "https://copy.fail"
      reference_2 = "https://github.com/tgies/copy-fail-c"
      reference_3 = "https://github.com/theori-io/copy-fail-CVE-2026-31431"
      reference_4 = "https://hackerspace.pl/~q3k/alpine.py"
      reference_5 = "https://github.com/badsectorlabs/copyfail-go"
      reference_6 = "https://github.com/iss4cf0ng/CVE-2026-31431-Linux-Copy-Fail"
      date = "2026-04-30"
      score = 75
   strings:
      // Network indicators (e.g. in bash history, logs, etc.)
      $xn1 = "curl https://copy.fail/exp" ascii

      // Code fragments from public PoCs
      $xs1 = "| python3 && su"
      $xs2 = "g.open(\"/usr/bin/su\",0);i=0;"
      $xs3 = "[-] page-cache mutation failed"
      $xs4 = "[+] /etc/passwd page cache mutated"
      $xs5 = "bind(AF_ALG: authencesn(hmac(sha256),cbc(aes)))"
      $xs6 = "/tmp/.cve_test"

      // Indicator Combo
      $sa1 = "authencesn(hmac(sha256),cbc(aes))" ascii

      $sb1 = { 08 00 01 00 00 00 00 10 }
      $sb2 = "[PII_REDACTED]" ascii

      // Base64 encoded payloads
      $xe1 = "authencesn(hmac(sha256),cbc(aes))" base64

      // Tiny x86-64 ELF shell payload: setuid(0) -> execve("/bin/sh") -> exit(0)
      $xc1 = { 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 02 00 3e 00 01 00 00 00 78 00 40 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 38 00 01 00 00 00 00 00 00 00 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 9e 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 31 c0 31 ff b0 69 0f 05 48 8d 3d 0f 0