huntrule

Nginx Worker Core Dump Indicating Crash or Possible Exploitation

Flags Nginx worker crashes that end with signal 6 core dumps, which may indicate serious issues or exploitation.

FreeUnreviewedSigmahighv1
title: Nginx Worker Core Dump Indicating Crash or Possible Exploitation
id: c1c8b567-7029-46c5-a6a1-db90669653d0
status: test
description: This rule matches log entries indicating a crashing Nginx worker terminated with signal 6 and produced a core dump. A core dump can point to serious instability or memory-corruption conditions that may be triggered by exploitation attempts. It relies on service logs from Nginx containing the specific termination text pattern 'exited on signal 6 (core dumped)'.
references:
  - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
  - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/nginx/web_nginx_core_dump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-31
modified: 2023-05-08
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  service: nginx
detection:
  keywords:
    - exited on signal 6 (core dumped)
  condition: keywords
falsepositives:
  - Serious issues with a configuration or plugin
level: high
license: DRL-1.1
related:
  - id: 59ec40bb-322e-40ab-808d-84fa690d7e56
    type: derived

What it detects

This rule matches log entries indicating a crashing Nginx worker terminated with signal 6 and produced a core dump. A core dump can point to serious instability or memory-corruption conditions that may be triggered by exploitation attempts. It relies on service logs from Nginx containing the specific termination text pattern 'exited on signal 6 (core dumped)'.

Known false positives

  • Serious issues with a configuration or plugin

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.