Falco high stable other
Unprivileged Delegation of Page Faults Handling to a Userspace Process
Detect a successful unprivileged userfaultfd syscall, which could serve as an attack primitive for exploiting other vulnerabilities. To fine-tune this rule, consider using the template list "user_known_userfaultfd_processes".
Detection Logic
evt.type = userfaultfd and user.uid != 0 and (evt.rawres >= 0 or evt.res != -1) and not proc.name in (user_known_userfaultfd_processes)Field Validations
Loading…
Comments (0)
Loading comments...