Sigma rule: Buffer Overflow Attempts

Rule

Title

Buffer Overflow Attempts

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2017-03-01

Modified

2025-03-17

File

rules/linux/builtin/lnx_buffer_overflows.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects buffer overflow attempts in Unix system log files

Log source

product

linux

Detection

keywords:
    - 'attempt to execute code on stack by'
    - '0bin0sh1'
    # - 'rpc.statd[\d+]: gethostbyname error for'  # it's an expensive regex and produces questionable results
    - 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'  # this can cause false positives in Base64 encoded data
    - 'stack smashing detected'
condition: keywords

False positives (as the rule lists them)

• Base64 encoded data in log entries

Tags

• attack.t1068
• attack.privilege-escalation

MITRE ATT&CK ids this rule names

• T1068

References

• https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml
• https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html
• https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802
• https://blu.org/mhonarc/discuss/2001/04/msg00285.php
• https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/builtin/lnx_buffer_overflows.yml