rules/linux/builtin/lnx_buffer_overflows.yml

title: Buffer Overflow Attempts
id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
status: stable
description: Detects buffer overflow attempts in Unix system log files
references:
    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml
author: Florian Roth (Nextron Systems)
date: 2017/03/01
tags:
    - attack.t1068
    - attack.privilege_escalation
logsource:
    product: linux
detection:
    keywords:
        - 'attempt to execute code on stack by'
        - 'FTP LOGIN FROM .* 0bin0sh'
        - 'rpc.statd[\d+]: gethostbyname error for'
        - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
    condition: keywords
falsepositives:
    - Unknown
level: high
Rule: Linux: buffer overflows 2017-03-01 08:38:33 +01:00			`title: Buffer Overflow Attempts`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`status: stable`
Update lnx_buffer_overflows.yml 2018-08-25 00:20:34 +02:00			`description: Detects buffer overflow attempts in Unix system log files`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
Reference Update [Batch 1] 2022-07-07 15:24:15 +01:00			`- https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml`
chore: add nextron authors tag 2023-02-01 11:14:59 +01:00			`author: Florian Roth (Nextron Systems)`
$frack113$ Order yaml field 2022-10-25 08:53:44 +02:00			`date: 2017/03/01`
			`tags:`
			`- attack.t1068`
			`- attack.privilege_escalation`
Rule: Linux: buffer overflows 2017-03-01 08:38:33 +01:00			`logsource:`
fix: product unix > linux 2022-03-24 11:40:51 +01:00			`product: linux`
Rule: Linux: buffer overflows 2017-03-01 08:38:33 +01:00			`detection:`
			`keywords:`
			`- 'attempt to execute code on stack by'`
			`- 'FTP LOGIN FROM .* 0bin0sh'`
			`- 'rpc.statd[\d+]: gethostbyname error for'`
			`- 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'`
			`condition: keywords`
			`falsepositives:`
fixed various spelling errors all over rules and source code 2021-02-24 14:43:13 +00:00			`- Unknown`
Rule: Linux: buffer overflows 2017-03-01 08:38:33 +01:00			`level: high`