Buffer Overflow Attempts

Detects buffer overflow attempts in Unix system log files

Rule Content

- title: Buffer Overflow Attempts
  id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
  description: Detects buffer overflow attempts in Unix system log files
  references:
  - https://github.com/ossec/ossec-hids/blob/master/etc/rules/attack_rules.xml
  logsource:
    product: unix
    service: null
    category: null
  detection:
    keywords:
    - attempt to execute code on stack by
    - FTP LOGIN FROM .* 0bin0sh
    - 'rpc.statd[\d+]: gethostbyname error for'
    - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
    condition: keywords
  falsepositives:
  - Unkown
  level: high

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='\*.keyword:(*attempt\ to\ execute\ code\ on\ stack\ by* OR *FTP\ LOGIN\ FROM\ .*\ 0bin0sh* OR *rpc.statd\[\\d\+\]\:\ gethostbyname\ error\ for* OR *AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA*)')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()