{"id":"377f33a1-4b36-4ee1-acee-1dbe4b43cfbe","title":"Suspicious VSFTPD Error Messages","description":"Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-07-05","modified":"2021-11-27","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"product":"linux","service":"vsftpd"},"falsepositives":["Unknown"],"references":["https://github.com/dagwieers/vsftpd/"],"source_path":"rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml","source_sha256":"955277148926b4fd458ba9152a2ff52c6b076af9b57b172c191e744a7ca69d96","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious VSFTPD Error Messages\nid: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe\nstatus: test\ndescription: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts\nreferences:\n    - https://github.com/dagwieers/vsftpd/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-07-05\nmodified: 2021-11-27\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    product: linux\n    service: vsftpd\ndetection:\n    keywords:\n        - 'Connection refused: too many sessions for this address.'\n        - 'Connection refused: tcp_wrappers denial.'\n        - 'Bad HTTP verb.'\n        - 'port and pasv both active'\n        - 'pasv and port both active'\n        - 'Transfer done (but failed to open directory).'\n        - 'Could not set file modification time.'\n        - 'bug: pid active in ptrace_sandbox_free'\n        - 'PTRACE_SETOPTIONS failure'\n        - 'weird status:'\n        - 'couldn''t handle sandbox event'\n        - 'syscall * out of bounds'\n        - 'syscall not permitted:'\n        - 'syscall validate failed:'\n        - 'Input line too long.'\n        - 'poor buffer accounting in str_netfd_alloc'\n        - 'vsf_sysutil_read_loop'\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/377f33a1-4b36-4ee1-acee-1dbe4b43cfbe.json","kind":"sigma"}