Suspicious Apache Threading Error (via apache)

title: Suspicious Apache Threading Error (via apache)
id: 3401a337-9254-5381-8ef5-f631ebf5bc55
status: stable
description: This rule detects an issue in apache logs that reports threading related errors
references:
    - https://attack.mitre.org/techniques/T1210/
    - https://attack.mitre.org/techniques/T1190/
    - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md
author: Huntrule Team
date: 2026-01-05
tags:
    - attack.initial-access
    - attack.lateral-movement
    - attack.t1190
    - attack.t1210
logsource:
    service: apache
    definition: 'Requirements: Must be able to collect the error.log file'
detection:
    keywords:
        - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)'
    condition: keywords
falsepositives:
    - Unknown
level: medium