Rule Document 1:67107

Rule Category

OS-LINUX -- Snort has detected traffic targeting vulnerabilities in a Linux-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-LINUX Linux Kernel out-of-bounds write attempt

Rule Explanation

This rule looks for a set of specific op codes present in a malicious ELF binary.

What To Look For

This rule looks for attempts to exploit an out of bounds write vulnerability in the Linux Kernel.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group