huntrule

Nginx service core dump after worker crash (signal 6)

Flags Nginx worker crashes that end with signal 6 core dumps, which may indicate serious issues or exploitation.

FreeReviewedSigma · High · v2
Service
nginx
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-05-31
Updated
2026-07-31
AnalysisDetection
title: Nginx service core dump after worker crash (signal 6)
id: c1c8b567-7029-46c5-a6a1-db90669653d0
status: test
description: This rule flags log entries indicating an Nginx worker process “exited on signal 6 (core dumped),” which corresponds to a core dump being generated after a crash. Core dumps can indicate a serious stability or runtime problem and may also occur during exploitation attempts. The detection relies on Nginx service log messages that contain the specific core-dump wording.
references:
  - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
  - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/product/nginx/web_nginx_core_dump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-31
modified: 2023-05-08
tags:
  - attack.impact
  - attack.t1499.004
logsource:
  service: nginx
detection:
  keywords:
    - exited on signal 6 (core dumped)
  condition: keywords
falsepositives:
  - Serious issues with a configuration or plugin
level: high
license: DRL-1.1
related:
  - id: 59ec40bb-322e-40ab-808d-84fa690d7e56
    type: derived