auditd[.]dataDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 1 month ago
What the reports say
4 reports, newest first · the exact sentence from each-
Linux Detection Engineering - Local Privilege Escalation“auditd[.]data.a0 in (”
-
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild“(event.category == "process" and auditd.data.syscall == "socket" and auditd[.]data.a0 in ("26", "21")) or”
-
Hooked on Linux: Rootkit Detection Engineering“auditd.data.syscall == "kill" and auditd[.]data.a1 in (”
-
Linux detection engineering with Auditd“Returning to our original event, you are now ready to understand the auditd[.]data.a0-a3 fields.”
Indicators reported together
named in the same reports- process.parent[.]pidin 3 reports
- process[.]pidin 2 reports
- auditd.data.socket[.]familyin 1 report
- hxxps://copy[.]fail/in 1 report
- copy[.]failin 1 report
- hxxps://xint[.]io/blog/copy-fail-linux-distributionsin 1 report
- xint[.]ioin 1 report
- hxxps://github[.]com/V4bel/dirtyfrag/tree/masterin 1 report
- hxxps://github[.]com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo/in 1 report
- hxxps://aws.amazon[.]com/security/security-bulletins/2026-027-aws/in 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-46331, CVE-2026-64531, CVE-2026-43503, CVE-2026-46243, CVE-2026-46333
Thanks — we review every report.