{"id":"18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781","title":"Buffer Overflow Attempts","description":"Detects buffer overflow attempts in Unix system log files","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-01","modified":"2025-03-17","tags":["attack.t1068","attack.privilege-escalation"],"technique_ids":["T1068"],"logsource":{"product":"linux"},"falsepositives":["Base64 encoded data in log entries"],"references":["https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml","https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html","https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802","https://blu.org/mhonarc/discuss/2001/04/msg00285.php","https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/"],"source_path":"rules/linux/builtin/lnx_buffer_overflows.yml","source_sha256":"9560ea4416c85ab76d1de421322016976370b3c937aa24851e1bc2188bb1af71","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_buffer_overflows.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Buffer Overflow Attempts\nid: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781\nstatus: test\ndescription: Detects buffer overflow attempts in Unix system log files\nreferences:\n    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml  # OSSEC attack detection rules​:contentReference[oaicite:6]{index=6}​:contentReference[oaicite:7]{index=7}\n    - https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html  # Exec stack syslog message (noexec_user_stack)​:contentReference[oaicite:8]{index=8}\n    - https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802  # WU-FTPD exploit \"0bin0sh\" analysis​:contentReference[oaicite:9]{index=9}\n    - https://blu.org/mhonarc/discuss/2001/04/msg00285.php  # RPC.statd exploit attempt log example​:contentReference[oaicite:10]{index=10}\n    - https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/  # Stack smashing protector alert example​:contentReference[oaicite:11]{index=11}\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-03-01\nmodified: 2025-03-17\ntags:\n    - attack.t1068\n    - attack.privilege-escalation\nlogsource:\n    product: linux\ndetection:\n    keywords:\n        - 'attempt to execute code on stack by'\n        - '0bin0sh1'\n        # - 'rpc.statd[\\d+]: gethostbyname error for'  # it's an expensive regex and produces questionable results\n        - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'  # this can cause false positives in Base64 encoded data\n        - 'stack smashing detected'\n    condition: keywords\nfalsepositives:\n    - Base64 encoded data in log entries\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"}],"data_path":"data/detection-rules/18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781.json","kind":"sigma"}