Apache Error Log Threading Assertion Detected

Flags Apache error log entries that include a pthread thread-priority assertion failure message.

FreeUnreviewedSigmamediumv1

apache-error-log-threading-assertion-detected-e9a2b582

title: Apache Error Log Threading Assertion Detected
id: bf3ef5eb-1a36-4d1f-a975-7f344a9fddfd
status: test
description: This rule matches an Apache error log message containing a threading-related assertion in __pthread_tpp_change_priority. Such messages indicate a failure in thread priority handling within the server process, which can be relevant for spotting abnormal conditions or exploit attempts that lead to crashes or unstable behavior. The detection relies on the presence of a specific threading assertion string in Apache service error logs.
references:
  - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/apache/web_apache_threading_error.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-22
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.lateral-movement
  - attack.t1190
  - attack.t1210
logsource:
  service: apache
  definition: "Requirements: Must be able to collect the error.log file"
detection:
  keywords:
    - "__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)"
  condition: keywords
falsepositives:
  - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185
level: medium
license: DRL-1.1
related:
  - id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
    type: derived

What it detects

This rule matches an Apache error log message containing a threading-related assertion in __pthread_tpp_change_priority. Such messages indicate a failure in thread priority handling within the server process, which can be relevant for spotting abnormal conditions or exploit attempts that lead to crashes or unstable behavior. The detection relies on the presence of a specific threading assertion string in Apache service error logs.

Known false positives

3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.