huntrule

Apache service crashes: Segmentation Fault message in Apache error logs

Alerts on Apache error log lines showing a worker process crashed with an exit signal Segmentation Fault.

FreeUnreviewedSigmahighv1
title: "Apache service crashes: Segmentation Fault message in Apache error logs"
id: e5780ca5-31be-4e76-9457-927530a4a940
status: test
description: This rule flags Apache error log entries containing the specific phrase indicating a worker process terminated due to a segmentation fault. Such crashes can indicate exploitation attempts, misconfigurations, or destabilizing conditions that attackers may leverage to impact availability. It relies on Apache service error log content, specifically the presence of the “exit signal Segmentation Fault” keyword.
references:
  - http://www.securityfocus.com/infocus/1633
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/apache/web_apache_segfault.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-28
modified: 2021-11-27
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  service: apache
  definition: "Requirements: Must be able to collect the error.log file"
detection:
  keywords:
    - exit signal Segmentation Fault
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1da8ce0b-855d-4004-8860-7d64d42063b1
    type: derived

What it detects

This rule flags Apache error log entries containing the specific phrase indicating a worker process terminated due to a segmentation fault. Such crashes can indicate exploitation attempts, misconfigurations, or destabilizing conditions that attackers may leverage to impact availability. It relies on Apache service error log content, specifically the presence of the “exit signal Segmentation Fault” keyword.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.