detection rule from utkonos@malwarolo.gy.
“i am still refining it. two of the byte strings are purely defensive and don’t match in the poc. i’m working on a better rule based on control flow in the poc right now. but that’s a bit more intense a process than spitting out strings.”
rule ITScape_ExploitConstants_1
{
meta:
author = "Malware Utkonos"
date = "2026-05-11"
description = "Detects constants used in ITScape exploit PoC."
reference = "https://github.com/V4bel/ITScape/blob/main/poc.c"
strings:
$orderly_poweroff = { 2cf90d800080ffff }
$poweroff_cmd = { c803d0820080ffff }
$neigh_gc_work_fund = { 502d1d830080ffff }
$pmu_fn_linked = { b80e09800080ffff }
$gadget_rt = { dcc6d7800080ffff }
// canary magic ("LEAKLEAD" = 0x4c45414b4c454144 byte-swapped)
$leak_sentinel = { 4441454c4b41454c }
// payload: "/bin/touch /ITScape" packed as three u64s
$sc_write_bin_tou = { 2f62696e2f746f75 } // /bin/tou
$sc_write_ch_ITSc = { 6368202f49545363 } // ch /ITSc
$sc_write_ape = { 6170650000000000 } // ape\0
condition:
5 of them
}
rule ITScape_KVM_PrivDrop_1
{
meta:
author = "Malware Utkonos"
date = "2026-05-11"
description = "Detects /dev/kvm group rw check and drop to setgroups/setgid/setuid(1000) used in ITScape PoC."
strings:
$kvm = "/dev/kvm"
$op = { e0??4?b9 00041f12 1f180071 ?1[2]54 010080d2 000080d2 [3]9? 007d8052 [3]9? ?0[2]35 007d8052 [3]9? ?0[2]35 }
// 004025cc e0c340b9 ldr w0, [sp, #0xc0 {guest_memfd.reserved[0].d}] // load stat st_mode; offset floats
// 004025d0 00041f12 and w0, w0, #0x6 // mask S_IRGRP|S_IWGRP (0x4|0x2)
// 004025d4 1f180071 cmp w0, #0x6 // both group rw bits must be set
// 004025d8 c1f0ff54 b.ne 0x4023f0
// 004025dc 010080d2 mov x1, #0 // setgroups(0, NULL)
// 004025e0 000080d2 mov x0, #0
// 004025e4 b3feff97 bl setgroups
// 004025e8 007d8052 mov w0, #0x3e8 // setgid(1000)
// 004025ec 71feff97 bl setgid
// 004025f0 00f0ff35 cbnz w0, 0x4023f0
// 004025f4 007d8052 mov w0, #0x3e8 // setuid(1000)
// 004025f8 a6fdff97 bl setuid
// 004025fc a0efff35 cbnz w0, 0x4023f0
condition:
$kvm and $op
}