CrackArmor PoC or Exploit Artifact 2026 protection yara rules

We are publishing a YARA rule to be inserted into /usr/share/BastionGuard/data/yara/.

sudo nano Linux_CrackArmor_PoC_or_Exploit_Artifact_2026.yara

rule Linux_CrackArmor_PoC_or_Exploit_Artifact_2026
{
    meta:
        author = "Calogero Scarnà"
        date = "2026-03-13"
        description = "Heuristic detection for CrackArmor/AppArmor exploit artifacts (PoC, script, ELF)"
        reference = "Qualys CrackArmor advisory, March 2026"
        confidence = "medium"
        scope = "file"

    strings:
        /* Core CrackArmor / AppArmor abuse indicators */
        $s1 = "/sys/kernel/security/apparmor/.load" ascii
        $s2 = "/sys/kernel/security/apparmor/.replace" ascii
        $s3 = "/sys/kernel/security/apparmor/.remove" ascii
        $s4 = "aa_loaddata" ascii
        $s5 = "__remove_profile" ascii
        $s6 = "__aa_profile_list_release" ascii

        /* Exploit-chain indicators mentioned in the advisory */
        $s7  = "MAIL_CONFIG" ascii
        $s8  = "/usr/sbin/sendmail" ascii
        $s9  = "sendmail" ascii
        $s10 = "CAP_SETUID" ascii
        $s11 = "/etc/passwd" ascii
        $s12 = "/usr/bin/time" ascii
        $s13 = "userns" ascii
        $s14 = "deny-all" ascii
        $s15 = "sudo" ascii
        $s16 = "apparmor_parser" ascii
        $s17 = "unconfined" ascii
        $s18 = "change_profile" ascii

        /* Optional naming overlap */
        $tag1 = "CrackArmor" ascii nocase
        $tag2 = "AppArmor Local Privilege Escalation" ascii nocase

        /* ELF header */
        $elf = { 7F 45 4C 46 }

    condition:
        (
            /* Scripts, source, notes, PoC */
            3 of (
                $s1, $s2, $s3,
                $s7, $s8, $s9,
                $s10, $s11, $s12,
                $s13, $s14, $s15,
                $s16, $s17, $s18,
                $tag1, $tag2
            )
        )
        or
        (
            /* Compiled ELF with stronger signal */
            $elf at 0
            and 2 of ($s1, $s2, $s3)
            and 2 of (
                $s4, $s7, $s10,
                $s11, $s12, $s13,
                $s15, $s16, $s17,
                $s18, $tag1, $tag2
            )
        )
        or
        (
            /* Kernel/DoS oriented PoC flavor */
            1 of ($s1, $s2, $s3)
            and 2 of ($s4, $s5, $s6, $s14)
        )
}

This YARA rule provides heuristic detection of potential CrackArmor/AppArmor exploit artifacts, including proof-of-concept scripts, source files, and compiled ELF binaries. It is intended to identify suspicious files associated with possible privilege-escalation attempts, rather than directly prevent exploitation.

Restart BastionGuard Real-Time Protection

After saving the YARA rule, restart the BastionGuard real-time protection service:

sudo systemctl restart BastionGuard-ransomware-realtime.service

Warning: This heuristic rule may generate false positives. It is intended for testing and research purposes only and is not recommended for production environments without additional validation and tuning.