Linux auditd AF_ALG (Address Family 38) socket() syscall creation

title: Linux auditd AF_ALG (Address Family 38) socket() syscall creation
id: de5a5192-0a45-4255-b817-50cc9fe74280
status: experimental
description: This rule identifies attempts to create an AF_ALG socket (address family value 38) by matching the Linux socket() syscall recorded in auditd. AF_ALG is the kernel crypto API interface, which can be a target for privilege-escalation activity because it provides a pathway into kernel crypto handling. The detection relies on auditd syscall telemetry that logs the socket() syscall and captures the address family argument used to initiate AF_ALG sockets. It also suppresses known legitimate processes such as cryptsetup and specific IPsec/VPN or kernel-crypto benchmarking utilities.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
  - https://man7.org/linux/man-pages/man2/socket.2.html
  - https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
  - https://xint.io/blog/copy-fail-linux-distributions
  - https://github.com/theori-io/copy-fail-CVE-2026-31431
  - https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2026-04-30
tags:
  - attack.privilege-escalation
  - attack.t1068
  - detection.emerging-threats
  - cve.2026-31431
logsource:
  product: linux
  service: auditd
  definition: |
    Required auditd configuration:
    auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect
detection:
  selection:
    type: SYSCALL
    SYSCALL: socket
    a0: 26
  filter_main_legitimate:
    exe|endswith:
      - /cryptsetup
      - /kcapi-speed
      - /kcapi-enc
      - /kcapi-dgst
      - /charon
      - /charon-systemd
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
  - Libkcapi userspace tools for kernel crypto API benchmarking
  - StrongSwan IKE daemon with kernel-libipsec plugin
level: high
license: DRL-1.1
related:
  - id: 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
    type: derived