On this page
OSSEC / HIDS Rule 61027
- Rule family: OSSEC / HIDS
- Rule ID: 61027
- Definition status: Present in current source
- Alert message / subject: Denied a RWX mprotect event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel.
- Rule level: 8
- Definition checked: 2026-10-21
Interpretation and response
The kernel reported a denied writable/executable memory-protection operation. Investigate the program, its integrity and legitimate runtime requirements.
An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.
The kernel supplies this protection; the HIDS rule reports the event. No single memory policy guarantees that every exploit is prevented.
Documentation
The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.
Description
The kernel reported a denied writable/executable memory-protection operation. Investigate the program, its integrity and legitimate runtime requirements.
Log examples
Illustrative event summary (not a captured log): OSSEC/HIDS 61027 — Denied a RWX mprotect event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..
Illustrative event summary (not a captured log): OSSEC/HIDS 61027 — Denied a RWX mprotect event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..
Log examples of Trojans
Illustrative event summary (not a captured log): OSSEC/HIDS 61027 — Denied a RWX mprotect event. An application just attmpted to use the mprotect function to bypass memory protection functions in the kernel..
In the example above, this was generated from a trojaned version of sshd. Always confirm that your applications needs to open this hole in your system. More often than not, the application either does not need to do this, or its malicious.
Troubleshooting
Solutions
Please see this article for solutions if your application has this vulnerability:
ASL error messages (historical reference)
False Positives
Investigate both malicious activity and legitimate application compatibility issues.
If you are certain this is not an attack, or your application has not been replaced by a malicious backdoored version, please report this to support if you know this is not an attack and include the log messages along with the alert ID. Reporting just the rule ID will not provide the information we will need to help you.
Additional Information
Similar Rules
Source and revision
Migrated from HIDS_61027, wiki page 530, revision 5829 (20170220). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.
For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .