Detection Rules

Detection engineering repository containing:

• Wazuh detection rules
• Auditd syscall monitoring
• Linux threat hunting content
• CVE-specific detections
• Detection engineering research

---

Current CVEs

CVE	Description	Detection
CVE-2026-31431	Linux Kernel Copy Fail Local Privilege Escalation	Wazuh + Auditd

---

Repository Structure

Detection-Rules/
└── CVEs/
    └── CVE-2026-31431/

---

Detection Coverage

Current detections include:

• AF_ALG socket monitoring
• splice() syscall monitoring
• execve monitoring
• privilege escalation detection
• syscall telemetry correlation

---

Platforms

• Wazuh
• Auditd
• Linux
• Rocky Linux
• AlmaLinux
• RHEL

---

MITRE ATT&CK

Technique	Description
T1068	Exploitation for Privilege Escalation
T1203	Exploitation for Client Execution

---