Linux Syslog Buffer Overflow and Stack-Smashing Attempt Keywords

title: Linux Syslog Buffer Overflow and Stack-Smashing Attempt Keywords
id: 5377fc6a-829a-48d4-9366-7362c373ca22
status: test
description: This rule flags potential buffer overflow or stack-smashing attempts found in Unix/Linux system log lines by matching specific attack-related keyword strings. Attackers may attempt to trigger memory corruption to gain code execution, so early keyword-based alerts can highlight exploitation attempts even when full payload context is unavailable. The detection relies on text in Linux system log telemetry, matching the configured keywords exactly or as substrings within log messages.
references:
  - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml
  - https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html
  - https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802
  - https://blu.org/mhonarc/discuss/2001/04/msg00285.php
  - https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_buffer_overflows.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-01
modified: 2025-03-17
tags:
  - attack.t1068
  - attack.privilege-escalation
logsource:
  product: linux
detection:
  keywords:
    - attempt to execute code on stack by
    - 0bin0sh1
    - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    - stack smashing detected
  condition: keywords
falsepositives:
  - Base64 encoded data in log entries
level: high
license: DRL-1.1
related:
  - id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
    type: derived