I am trying to detect buffer overflow by using OSSEC (a HIDS software) as mentioned in OSSEC rules example and OSSEC book.
How can I configure OSSEC for detect a simple buffer overflow example as the following:
#include <string.h>
#include <stdio.h>
void main(int argc, char *argv[]) {
char buffer[100];
strcpy(buffer, argv[1]);
printf("Done!\n");
}
Bear in mind that OSSEC is a log-based HIDS. Knowing that, it is clear that OSSEC will be able to react only if someone (eg.: a daemon) adds a log that matches some Buffer Overflow rule.
See the official code example that you've mentioned.
If you are looking for detection of stage-one attacks (shellcode in a process) there is EMET, WDEG aka EMET II (for Windows) and Lotan (cross-platform).
Leviathan Security has posted on Lotan at least twice here:
EMET has been capable of similar through the 3.0 Notifier or the 5.5 Event-Log mechanisms.
