huntrule

Apache thread assertion error in error.log

Flags Apache error log entries that include a pthread thread-priority assertion failure message.

FreeReviewedSigma · Medium · v2
Service
apache
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2019-01-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Apache error log entries containing a specific pthread thread priority assertion message. Such messages indicate failures in threading-related operations within the Apache process, which attackers may leverage as part of triggering abnormal server behavior. The detection relies on keyword hits in Apache error logs, specifically the exact assertion string reported by the underlying threading code.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Possible .NET Remoting Deserialisation Exploitation via REM Endpoint
Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)
Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)
Malicious WordPress Core SQL Injection Scanner via User-Agent
Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)
Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)
Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)
Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)
Apache thread assertion error in error.log
Pivot detection · T1190 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.