Apache worker crash logs with "Segmentation Fault" exit signal
Alerts on Apache error log lines showing a worker process crashed with an exit signal Segmentation Fault.
- Service
- apache
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-02-28
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule matches Apache service error log entries containing the text indicating a worker process exited due to a "Segmentation Fault". Such crashes can signal exploitation attempts or unstable conditions triggered by malformed requests, making them important impact telemetry. It relies on Apache error log content that includes the specific segmentation fault exit signal string.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Apache worker crash logs with "Segmentation Fault" exit signal
id: e5780ca5-31be-4e76-9457-927530a4a940
status: test
description: This rule matches Apache service error log entries containing the text indicating a worker process exited due to a "Segmentation Fault". Such crashes can signal exploitation attempts or unstable conditions triggered by malformed requests, making them important impact telemetry. It relies on Apache error log content that includes the specific segmentation fault exit signal string.
references:
- http://www.securityfocus.com/infocus/1633
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/apache/web_apache_segfault.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-02-28
modified: 2021-11-27
tags:
- attack.impact
- attack.t1499.004
logsource:
service: apache
definition: "Requirements: Must be able to collect the error.log file"
detection:
keywords:
- exit signal Segmentation Fault
condition: keywords
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1da8ce0b-855d-4004-8860-7d64d42063b1
type: derived