examples: add CVE-2024-6387 OpenSSH regreSSHion detection policy

[Bakomebandias]

Summary

Adds a TracingPolicy detecting exploitation of CVE-2024-6387 (regreSSHion) — the OpenSSH signal handler race condition allowing unauthenticated RCE as root.

Detection Method

• Monitors __x64_sys_clone from /usr/sbin/sshd
• Rate limit threshold: 30 clone() calls per 60s window
• Normal operation: <5/min. Under attack: >30/60s.

Files

• cve-2024-6387-openssh-regresshion.yaml — TracingPolicy
• VALIDATION-cve-2024-6387.md — Validation documentation

Checklist

• Policy YAML follows existing CVE example format
• Includes VALIDATION documentation
• Compatible with x86_64 and ARM64 (documented)

Fixes #1947

[Bakomebandias]

Summary

This PR adds a TracingPolicy to detect exploitation attempts against CVE-2024-6387 (regreSSHion) — a signal handler race condition in OpenSSH sshd that enables unauthenticated remote code execution as root (CVSS 8.1, Critical).

Detection Strategy

Component	Detail
Syscall monitored	__x64_sys_clone from /usr/sbin/sshd
Normal baseline	<5 clone() calls per minute
Attack threshold	>30 clone() calls per 60-second window
Rate limit	30/60s — prevents log flooding

Under exploitation, the attacker must trigger multiple SIGALRM handler invocations. Each attempt spawns a child process via clone(). This creates a measurable and detectable spike well above normal SSH connection patterns.

Files Changed

• examples/tracingpolicy/cves/cve-2024-6387-openssh-regresshion.yaml — TracingPolicy definition
• examples/tracingpolicy/cves/VALIDATION-cve-2024-6387.md — Environment, true/false positive baseline, compatibility

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6387
• Qualys advisory: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
• Affected versions: OpenSSH 8.5p1 through 9.8p1 on glibc-based Linux

Compatibility

• x86_64: __x64_sys_clone
• ARM64: __arm64_sys_clone (documented in VALIDATION)

Fixes #1947. Ready for review. Feedback and testing on additional architectures welcome.

[Bakomebandias]

Added: CVE-2016-5681 — AryStinger Detection

Added a second policy targeting CVE-2016-5681 (D-Link DIR-850L RCE), currently exploited in the wild by AryStinger malware (4,300+ infected routers).

Detection Method

Monitors for AryStinger's specific IOCs:

• Execution of binaries from /tmp/bin/syswapd* — the malware's known staging path
• File writes to /tmp/bin/ — the malware's persistence directory

Threat Intelligence

Reference: The Hacker News — June 22, 2026
https://thehackernews.com/2026/06/arystinger-malware-infects-4300-legacy.html

This PR now addresses #1947 with 2 real-world, threat-intelligence-driven CVE policies.

[mtardy]

Thanks for the contribution. The issue you mentioned is quite old now and the situation has changed a bit. See #5172. We are still thinking on how we can find a space for such policies