huntrule

Apache worker crash logs with "Segmentation Fault" exit signal

Alerts on Apache error log lines showing a worker process crashed with an exit signal Segmentation Fault.

FreeReviewedSigma · High · v2
Service
apache
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-02-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Apache service error log entries containing the text indicating a worker process exited due to a "Segmentation Fault". Such crashes can signal exploitation attempts or unstable conditions triggered by malformed requests, making them important impact telemetry. It relies on Apache error log content that includes the specific segmentation fault exit signal string.

Reporting behind it

Related detections2 linkedT1499.004 — drag to rearrange
Nginx service core dump after worker crash (signal 6)
Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Apache worker crash logs with "Segmentation Fault" exit signal
Pivot detection · T1499.004 · 2 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.