HP-UX Host Intrusion Detection System Version 4.3 administrator guide

A Templates and Alerts
This appendix describes the detection templates that constitute the surveillance groups. It also
describes the alerts that are passed to the System Manager and to the response programs by the
HIDS agent. This appendix addresses the following topics:
• “Alert Summary” (page 111)
• “Limitations” (page 115)
• “Template Property Types” (page 115)
• “Buffer Overflow Template” (page 121)
• “Race Condition Template” (page 125)
• “Modification of files/directories Template” (page 129)
• “Changes to Log File Template” (page 134)
• “Creation and Modification of setuid/setgid File Template” (page 138)
• “Creation of World-Writable File Template” (page 141)
• “Modification of Another User’s File Template” (page 144)
• “Login/Logout Template” (page 147)
• “Repeated Failed Logins Template” (page 151)
• “Repeated Failed su Commands Template” (page 153)
• “Log File Monitoring Template” (page 155)
Alert Summary
Table A-1 lists the attack detected, the alert severity, and the detection template that generates
the alert, for each alert.
Table A-1 Detection Templates
Detection TemplateAlert SeverityAttackAlert
Buffer Overflow
Template
1A process attempted to execute
on its stack, perhaps as part of a
stack buffer overflow attack.
Buffer overflow detected
Buffer Overflow
Template
1Potential buffer overflow of a
privileged program using an
unusually long program
argument, or using an argument
that contains a non-printable
character.
Potential buffer overflow
detected
Race Condition
Template
1A file reference for a privileged
program was modified.
File reference change
Race Condition
Template
1
A privileged setuid script was
executed using a symbolic link.
Race condition attack
Race Condition
Template
2
A privileged setuid script was
executed, but not necessarily
using a symbolic link.
Potential race condition
attack
Modification of
files/directories
Template
2The following operations were
either unsuccessfully or
successfully performed on a
read-only file:
• Truncation
• Deletion
• Renaming
File system modification
or potential modification
Alert Summary 111