Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path

Name:Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path
id:7c1c36e6-014d-4a2c-b3ab-84d7cec3bbc2
version:1
date:None
author:Raven Tait, Splunk
status:production
type:TTP
Description:The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock class privilege escalation exploits. When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module. In vulnerable kernels, this triggers a stale IOTLB metadata cache access path that allows an unprivileged user to write an arbitrary value to modprobe_path. The specific address family number varies by kernel and exploit variant (AF 41, 42, or any unregistered AF).
Data_source:

• -Linux Auditd Syscall

search:`linux_auditd`
type=SYSCALL
key=sock_raw_eafnosupport
success=no
exit="-97"
a1=3
exe IN (
"/dev/shm/*",
"/home/*",
"/run/user/*",
"/tmp/*",
"/var/tmp/*"
)

| rename host as dest

| stats count min(_time) as firstTime
max(_time) as lastTime
values(exe) as process_path
values(a0) as address_family
values(pid) as pid
values(ppid) as ppid

BY auid uid dest ses

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_auditd_sock_raw_eafnosupport_from_user_writable_path_filter`

how_to_implement:This detection requires auditd rules to capture failed socket() calls. Add the following rule to /etc/audit/rules.d/audit.rules to capture SOCK_RAW failures: -a always,exit -F arch=b64 -S socket -F a1=3 -F success=0 -F auid>=1000 -F auid!=unset -k sock_raw_eafnosupport -a always,exit -F arch=b32 -S socket -F a1=3 -F success=0 -F auid>=1000 -F auid!=unset -k sock_raw_eafnosupport These logs should be ingested and processed using the Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833).
known_false_positives:Legitimate processes almost never open a SOCK_RAW socket with an unregistered address family. The EAFNOSUPPORT error on a raw socket from a non-system path has no benign use case outside of socket fuzzing or explicit error-handling tests
References:
  -https://www.cve.org/CVERecord?id=CVE-2026-74580
  -https://github.com/Neo23x0/auditd
  -https://attack.mitre.org/techniques/T1068/
drilldown_searches:
 name:'View the detection results for - "$dest$" and "$auid$"'
 search:'%original_detection_search% | search dest = "$dest$" auid = "$auid$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$dest$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Linux Privilege Escalation', 'Compromised Linux Host']

asset_type:Endpoint

mitre_attack_id:['T1068']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/vghost/audit.log
  source: auditd
  sourcetype: auditd
 test_type:'unit'
manual_test:None