Linux: Detect authencesn crypto module load via modprobe (CVE-2026-31431 indicator)

Flags modprobe/kmod processes loading the authencesn crypto module when command lines contain "crypto-authencesn(".

FreeUnreviewedSigmahighv1

linux-detect-authencesn-crypto-module-load-via-modprobe-cve-2026-31431-indicator-474b415a

title: "Linux: Detect authencesn crypto module load via modprobe (CVE-2026-31431 indicator)"
id: 520007f6-c117-455b-a52f-de6192758777
status: experimental
description: This rule identifies Linux process activity where kernel crypto module autoloading invokes modprobe to load the authencesn crypto module. It matches process command lines that include the authencesn cipher spec ("crypto-authencesn(") along with modprobe execution (either via an /usr/bin/kmod wrapper or /modprobe directly). This matters because attackers can use AF_ALG and specific AEAD selections to trigger kernel behaviors associated with CVE-2026-31431 exploitation paths, making this command-line combination a useful high-fidelity indicator. Telemetry relies on process creation data including Image and CommandLine fields.
references:
  - https://www.linkedin.com/posts/stamatis-chatzimangou_copyfail-kql-activity-7455582422215114752-S4RW/
  - https://www.splunk.com/en_us/blog/security/detecting-copy-fail-cve-2026-31431-phenomenal-power-itty-bitty-script.html
  - https://nvd.nist.gov/vuln/detail/CVE-2026-31431
  - https://man7.org/linux/man-pages/man8/modprobe.8.html
  - https://www.kernel.org/doc/html/latest/crypto/userspace-if.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-31431/proc_creation_lnx_exploit_cve_2026_31431_copyfail.yml
author: Gene Kazimiarovich, Huntrule Team
date: 2026-05-09
tags:
  - attack.privilege-escalation
  - attack.t1068
  - attack.persistence
  - attack.t1547.006
  - detection.emerging-threats
  - cve.2026-31431
logsource:
  category: process_creation
  product: linux
detection:
  selection_kmod:
    Image|endswith: /kmod
    CommandLine|contains|all:
      - modprobe
      - crypto-authencesn(
  selection_modprobe:
    Image|endswith: /modprobe
    CommandLine|contains: crypto-authencesn(
  condition: 1 of selection_*
falsepositives:
  - Legitimate manual loading of the authencesn module by administrators for kernel crypto benchmarking or IPsec configuration (near-zero in production)
level: high
license: DRL-1.1
related:
  - id: 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
    type: derived

What it detects

This rule identifies Linux process activity where kernel crypto module autoloading invokes modprobe to load the authencesn crypto module. It matches process command lines that include the authencesn cipher spec ("crypto-authencesn(") along with modprobe execution (either via an /usr/bin/kmod wrapper or /modprobe directly). This matters because attackers can use AF_ALG and specific AEAD selections to trigger kernel behaviors associated with CVE-2026-31431 exploitation paths, making this command-line combination a useful high-fidelity indicator. Telemetry relies on process creation data including Image and CommandLine fields.

Known false positives

Legitimate manual loading of the authencesn module by administrators for kernel crypto benchmarking or IPsec configuration (near-zero in production)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.