On this page

OSSEC / HIDS Rule 60227

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 60227
  • Definition status: Historical / version-dependent
  • Alert message / subject: Denied memory-protection operation

This ID was not found in the reviewed main HIDS rules directory. It may belong to an older release or a generated integration. Check your installed rule bundle before applying its guidance.

Interpretation and response

The historical page describes a denied PaX/grsecurity mprotect operation. Investigate whether the application is trusted, supported and expected to require executable memory.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

This ID is absent from the current main HIDS rules. Do not assume that a historic kernel policy, exception command or Active Response setting applies to your installed product.

Documentation

This article preserves historical OSSEC/HIDS guidance. This ID was not found in the current main rule directory; the historical status, response defaults and product instructions do not establish its behavior in a current deployment.

Explanation:

The historical page describes a denied PaX/grsecurity mprotect operation. Investigate whether the application is trusted, supported and expected to require executable memory.

Tuning Recommendations

Obtain version-specific guidance before changing executable-memory policy. The original example and exception instructions concerned older ASL kernels.

Source and revision

Migrated from HIDS_60227, wiki page 240, revision 5828 (20170220). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .