Sigma rule: Suspicious VSFTPD Error Messages

Rule

Title

Suspicious VSFTPD Error Messages

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2017-07-05

Modified

2021-11-27

File

rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Log source

product

linux

service

vsftpd

Detection

keywords:
    - 'Connection refused: too many sessions for this address.'
    - 'Connection refused: tcp_wrappers denial.'
    - 'Bad HTTP verb.'
    - 'port and pasv both active'
    - 'pasv and port both active'
    - 'Transfer done (but failed to open directory).'
    - 'Could not set file modification time.'
    - 'bug: pid active in ptrace_sandbox_free'
    - 'PTRACE_SETOPTIONS failure'
    - 'weird status:'
    - 'couldn''t handle sandbox event'
    - 'syscall * out of bounds'
    - 'syscall not permitted:'
    - 'syscall validate failed:'
    - 'Input line too long.'
    - 'poor buffer accounting in str_netfd_alloc'
    - 'vsf_sysutil_read_loop'
condition: keywords

False positives (as the rule lists them)

• Unknown

Tags

• attack.initial-access
• attack.t1190

MITRE ATT&CK ids this rule names

• T1190

References

• https://github.com/dagwieers/vsftpd/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml