Detection: Linux Auditd SOCK RAW EAFNOSUPPORT From User Writable Path

Created: 2026-10-19 Last Updated: 2026-10-19 ID: 7c1c36e6-014d-4a2c-b3ab-84d7cec3bbc2 Author: Raven Tait, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects a process executing from a user-writable directory calling socket() with SOCK_RAW (a1=3) and receiving EAFNOSUPPORT (exit=-97, errno 97). This is the kernel trigger for vhost-vsock class privilege escalation exploits. When socket() is called with an unregistered address family and SOCK_RAW, the kernel calls request_module() to attempt to load a matching protocol module. In vulnerable kernels, this triggers a stale IOTLB metadata cache access path that allows an unprivileged user to write an arbitrary value to modprobe_path. The specific address family number varies by kernel and exploit variant (AF 41, 42, or any unregistered AF).

Search

 1`linux_auditd`
 2type=SYSCALL
 3key=sock_raw_eafnosupport
 4success=no
 5exit="-97"
 6a1=3
 7exe IN (
 8    "/dev/shm/*",
 9    "/home/*",
10    "/run/user/*",
11    "/tmp/*",
12    "/var/tmp/*"
13)
14
15
16| rename host as dest
17
18
19| stats count min(_time) as firstTime
20              max(_time) as lastTime
21              values(exe) as process_path
22              values(a0) as address_family
23              values(pid) as pid
24              values(ppid) as ppid
25
26  BY auid uid dest ses
27
28
29| `security_content_ctime(firstTime)`
30
31| `security_content_ctime(lastTime)`
32
33| `linux_auditd_sock_raw_eafnosupport_from_user_writable_path_filter`

Data Source

Name	Platform	Sourcetype	Source
Linux Auditd Syscall	Linux	`'auditd'`	`'auditd'`

Macros Used

Name	Value
linux_auditd	`sourcetype="auditd"`
linux_auditd_sock_raw_eafnosupport_from_user_writable_path_filter	`search *`

linux_auditd_sock_raw_eafnosupport_from_user_writable_path_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1068	Exploitation for Privilege Escalation	Privilege Escalation

Exploitation

DE.CM

CIS 10

CVE

CVE-2026-74580

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This detection requires auditd rules to capture failed socket() calls. Add the following rule to /etc/audit/rules.d/audit.rules to capture SOCK_RAW failures:

-a always,exit -F arch=b64 -S socket -F a1=3 -F success=0 -F auid>=1000 -F auid!=unset -k sock_raw_eafnosupport
-a always,exit -F arch=b32 -S socket -F a1=3 -F success=0 -F auid>=1000 -F auid!=unset -k sock_raw_eafnosupport

These logs should be ingested and processed using the Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833).

Known False Positives

Legitimate processes almost never open a SOCK_RAW socket with an unregistered address family. The EAFNOSUPPORT error on a raw socket from a non-system path has no benign use case outside of socket fuzzing or explicit error-handling tests

Associated Analytic Story

Finding

Title	Entity Field	Entity Type	Risk Score
Possible kernel exploit trigger via failed SOCK_RAW socket on [$dest$]	dest	system	50

Threat Objects

Field	Type
process_path	process_name

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`auditd`	`auditd`
Integration	✅ Passing	Dataset	`auditd`	`auditd`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1