A penetration tester successfully exploits a buffer overflow vulnerability in a network service and obtains a root shell. During the debrief, the client asks how they can detect this type of exploitation attempt. Which defensive technology is most effective at detecting exploitation of memory corruption vulnerabilities?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need IDS signatures for known exploit patterns plus EDR detecting anomalous process behavior, because buffer overflows often leave network and memory-level traces. Web app firewalls, patch scanners, and auth log review won't catch actual exploitation.
Full Explanation
The IDS signatures for known exploit patterns combined with EDR solutions detecting anomalous process behavior such as unexpected code execution in non-executable memory regions is correct because buffer overflow exploitation often produces network-level patterns detectable by IDS signatures, and modern EDR tools with exploit prevention capabilities detect memory-level anomalies such as ROP chains, shellcode execution in non-executable regions (bypassing DEP), and abnormal process behavior post-exploitation. The WAF blocking HTTP injection attempts is wrong because WAFs protect web applications; network service buffer overflow is separate attack vector. The vulnerability scanner identifying missing patches on affected service is wrong because vulnerability scanners identify vulnerability proactively but are not detection tools for active exploitation. Log analysis of successful authentication events to exploited service is wrong because successful authentication log analysis detects credential-based attacks; exploit-based root access bypasses normal authentication entirely.