HP-UX Host Intrusion Detection System Version 4.7 Administrator Guide HP-UX 11i v3 (766144-001, March 2014)

Alerts generated by this template
The following alerts are generated by the Race Condition template:
• “File Reference Modification” (page 117)
• “Privileged setuid Script Executed” (page 118)
File Reference Modification
Table A-7 lists the alert properties that the File Reference Modification template generates and
forwards to a response program when the file reference in a privileged program is modified
unexpectedly.
Table 17 File Reference Modification Alert Properties
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse
Program
Argument
Unique code assigned to
template.
1IntegerTemplate codeargv[1]
Version of the template.<version>IntegerVersionargv[2]
Alert severity.1IntegerSeverityargv[3]
UTC time in number of
seconds since epoch when
<secs>IntegerUTC Timeargv[4]
an unexpected file reference
was detected.
The user ID, group ID,
process ID, and parent
uid=<uid>, gid=<gid>, pid=<pid>,
ppid=<ppid>
StringAttackerargv[5]
process ID of the process, if
known, that modified a
privileged program’s file
reference. All values are set
to -1 if the attacker is not
known.
The full path name of the file
whose reference was
file=<full pathname>, type=<type>,
mode=<mode>, uid=<uid>,
StringTarget of Attackargv[6]
modified, and the file’s type,gid=<gid>, inode=<inode>,
device=<device> mode, uid, gid, inode, and
device number
Alert summaryFile reference changeStringSummaryargv[7]
Detailed alert descriptionFile reference for file
<fullpathname>(type=<type>,
StringDetailsargv[8]
inode=<inode>, device=<device), has
changed unexpectedly for process
with pid <pid> and ppid <ppid>
when executing <program>>(type=
<type>, inode=<inode>,
device=<device>). Attacker is process
<pid> when executing
<program>>(type=<type>,
inode=<inode>, device=<device>).
The event that triggered the
alert.
nullStringEventargv[9]
NOTE: See Table 41 (page 150) and Table 45 (page 152) Appendix B for the definition of
additional arguments that can be used to access specific alert information (for example, pid and
ppid) without parsing the string alert fields.
Race Condition Template 117