Buffer Overflow Attempts
Detects buffer overflow attempts in Unix system log files
Detection logic
Detection requirements
- Platform
- ContainersLinuxmacOSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- linux
Known benign triggers
- Base64 encoded data in log entries
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| blu.org/mhonarc/discuss/2001/04/msg00285.php | Only this detection cites it |
| docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html | Only this detection cites it |
| github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml | Only this detection cites it |
| rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/ | Only this detection cites it |
| www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802 | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
- Tagged by the source as
- attack.privilege-escalation
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1