Detections · Linux Kernel Unspecified Vulnerability

Public CTI triage - Linux

sigma · Pending service validation

title: Public CTI triage - Linux
id: 6f9541ff-56ff-5a80-bcbc-63ffe1d0ab83
status: experimental
description: Triage observable telemetry associated with the public report keyword.
references:
  - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json#CVE-2026-53362
logsource:
  category: process_creation
detection:
  selection:
    process.command_line: 'Linux'
  condition: selection
falsepositives:
  - Legitimate administrative or software activity
level: medium

SPL triage - Linux

spl · validation unavailable

index=* (CommandLine="*Linux*")

KQL triage - Linux

kql · validation unavailable

DeviceProcessEvents | where ProcessCommandLine contains "Linux"