huntrule

Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts

Looks for specific vsftpd error strings that may indicate exploitation-triggered faults or abnormal request handling.

FreeReviewedSigma · Medium · v3
Product
linux
Service
vsftpd
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-07-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags VSFTPD log entries containing specific error messages that reflect fatal or suspicious conditions often triggered during exploitation attempts. Attackers may provoke these states by sending malformed inputs, conflicting session parameters, or unexpected protocol/HTTP data to stress error handling paths. The detection relies on Linux VSFTPD service log events matching the listed keyword strings.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)
Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line
Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent
Suspicious TOLLBOOTH Webshell URI Access
Suspicious ffuf Fuzzing Requests Against Web Server
Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool
Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon
Suspicious Child Process Spawned by IIS Worker Process w3wp
Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility
Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts
Pivot detection · T1190 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.