Apache thread assertion error in error.log

Flags Apache error log entries that include a pthread thread-priority assertion failure message.

FreeReviewedSigma · Medium · v2

Service: apache
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-01-22
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Lateral Movement

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Apache error log entries containing a specific pthread thread priority assertion message. Such messages indicate failures in threading-related operations within the Apache process, which attackers may leverage as part of triggering abnormal server behavior. The detection relies on keyword hits in Apache error logs, specifically the exact assertion string reported by the underlying threading code.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Malicious WordPress Core SQL Injection Scanner via User-Agent

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

Apache thread assertion error in error.log

Pivot detection · T1190 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

apache-error-log-threading-assertion-detected-e9a2b582

title: Apache thread assertion error in error.log
id: bf3ef5eb-1a36-4d1f-a975-7f344a9fddfd
status: test
description: This rule matches Apache error log entries containing a specific pthread thread priority assertion message. Such messages indicate failures in threading-related operations within the Apache process, which attackers may leverage as part of triggering abnormal server behavior. The detection relies on keyword hits in Apache error logs, specifically the exact assertion string reported by the underlying threading code.
references:
  - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/apache/web_apache_threading_error.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-22
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.lateral-movement
  - attack.t1190
  - attack.t1210
logsource:
  service: apache
  definition: "Requirements: Must be able to collect the error.log file"
detection:
  keywords:
    - "__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)"
  condition: keywords
falsepositives:
  - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185
level: medium
license: DRL-1.1
related:
  - id: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL