Identifying exploitation of vulnerabilities using error reports

A system for analyzing error report data, the system comprising:

• a network connection for receiving error reports from a plurality of networked computers;
• a data store that stores error report data, from the error reports, related to errors that occurred on one or more of the networked computers;
• a system monitor that analyzes the error report data to identify an attempted exploit in a service of the one or more networked computers, and determines one or more of a location of attack, a type of service under attack, or a system configuration under attack;
• and
• a computer processor that is a functional part of the system and is activated by the system monitor to facilitate analyzing the error report data.

A computer-implemented method of determining whether an error report contains evidence of an exploit, the method comprising:

• receiving an error report including error data related to one or more errors within a computing system;
• performing, with a computer processor, exploit analysis on the error report, comprising at least one of:
• identifying, from the error report, information indicative of a known exploit at an executable memory location;
• identifying, from the error report, information indicative of NOPSleds;
• identifying, from the error report, information indicative of a decoder loop;
• identifying, from the error report, information indicative of a malicious text, a malicious string, or a malicious binary sequence;
• identifying, from the error report, information indicative of a disabled defense program;
• or
• identifying, from the error report, information indicative of a hijacked control structure;
• and
• identifying, from the error report, a location of a vulnerability that indicates a point of attack.