Linux auditd: Detect AF_ALG socket() syscall (address family 38) for crypto API abuse
Flags AF_ALG (38) socket() creations from Linux auditd while filtering common legitimate crypt/VPN tools.
- Product
- linux
- Service
- auditd
- Author
- Gene Kazimiarovich (SigmaHQ), DRL 1.1
- Published
- 2026-04-30
- Updated
- 2026-07-31
ATT&CK techniques
Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies processes creating AF_ALG sockets by matching the Linux socket() syscall argument for address family 38 via auditd. AF_ALG is the kernel crypto API interface, and attackers may use it to reach kernel code paths tied to cryptographic operations. The detection relies on auditd telemetry for the socket syscall and its recorded syscall arguments, and reduces noise by excluding a small set of known legitimate binaries.
Reporting behind it
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-31431
- man7.orghttps://man7.org/linux/man-pages/man2/socket.2.html
- kernel.orghttps://www.kernel.org/doc/html/latest/crypto/userspace-if.html
- xint.iohttps://xint.io/blog/copy-fail-linux-distributions
- github.comhttps://github.com/theori-io/copy-fail-CVE-2026-31431
- github.comhttps://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: Detect AF_ALG socket() syscall (address family 38) for crypto API abuse"
id: de5a5192-0a45-4255-b817-50cc9fe74280
status: experimental
description: This rule identifies processes creating AF_ALG sockets by matching the Linux socket() syscall argument for address family 38 via auditd. AF_ALG is the kernel crypto API interface, and attackers may use it to reach kernel code paths tied to cryptographic operations. The detection relies on auditd telemetry for the socket syscall and its recorded syscall arguments, and reduces noise by excluding a small set of known legitimate binaries.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-31431
- https://man7.org/linux/man-pages/man2/socket.2.html
- https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
- https://xint.io/blog/copy-fail-linux-distributions
- https://github.com/theori-io/copy-fail-CVE-2026-31431
- https://github.com/torvalds/linux/blob/81d6f7807536a0436dfada07e9292e3702d2bed4/include/linux/socket.h#L245
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-31431/lnx_auditd_exploit_cve_2026_31431_af_alg_socket_creation.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2026-04-30
tags:
- attack.privilege-escalation
- attack.t1068
- detection.emerging-threats
- cve.2026-31431
logsource:
product: linux
service: auditd
definition: |
Required auditd configuration:
auditctl -a always,exit -F arch=b64 -S socket -k af_alg_detect
detection:
selection:
type: SYSCALL
SYSCALL: socket
a0: 26
filter_main_legitimate:
exe|endswith:
- /cryptsetup
- /kcapi-speed
- /kcapi-enc
- /kcapi-dgst
- /charon
- /charon-systemd
condition: selection and not 1 of filter_main_*
falsepositives:
- Disk encryption utilities using kernel crypto offload (cryptsetup with --use-kernel-crypto)
- Libkcapi userspace tools for kernel crypto API benchmarking
- StrongSwan IKE daemon with kernel-libipsec plugin
level: high
license: DRL-1.1
related:
- id: 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
type: derived