Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags VSFTPD log entries containing specific error messages that reflect fatal or suspicious conditions often triggered during exploitation attempts. Attackers may provoke these states by sending malformed inputs, conflicting session parameters, or unexpected protocol/HTTP data to stress error handling paths. The detection relies on Linux VSFTPD service log events matching the listed keyword strings.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Suspicious Executable Run from IIS aspnet_client or Windows Tasks Directory via process_creation

Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)

Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line

Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent

Suspicious TOLLBOOTH Webshell URI Access

Suspicious ffuf Fuzzing Requests Against Web Server

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

Suspicious Child Process Spawned by IIS Worker Process w3wp

Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts

Pivot detection · T1190 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-vsftpd-suspicious-error-messages-indicating-potential-exploitation-attempt-377f33a1

title: "Linux VSFTPD Logs: Suspicious Error Messages Indicating Possible Exploitation Attempts"
id: 6a7b993f-c48e-4b13-bd67-d63b06fa6093
status: test
description: This rule flags VSFTPD log entries containing specific error messages that reflect fatal or suspicious conditions often triggered during exploitation attempts. Attackers may provoke these states by sending malformed inputs, conflicting session parameters, or unexpected protocol/HTTP data to stress error handling paths. The detection relies on Linux VSFTPD service log events matching the listed keyword strings.
references:
  - https://github.com/dagwieers/vsftpd/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-07-05
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: linux
  service: vsftpd
detection:
  keywords:
    - "Connection refused: too many sessions for this address."
    - "Connection refused: tcp_wrappers denial."
    - Bad HTTP verb.
    - port and pasv both active
    - pasv and port both active
    - Transfer done (but failed to open directory).
    - Could not set file modification time.
    - "bug: pid active in ptrace_sandbox_free"
    - PTRACE_SETOPTIONS failure
    - "weird status:"
    - couldn't handle sandbox event
    - syscall * out of bounds
    - "syscall not permitted:"
    - "syscall validate failed:"
    - Input line too long.
    - poor buffer accounting in str_netfd_alloc
    - vsf_sysutil_read_loop
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL