Detectionmediumtest

Apache Threading Error

Detects an issue in apache logs that reports threading related errors

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Tue Jan 22Updated Sat Nov 27e9a2b582-3f6a-48ac-b4a1-6849cdc50b3cweb

Log Source

apache

Serviceapache← raw: apache

Definition

Requirements: Must be able to collect the error.log file

Detection Logic

detection:
    keywords:
        - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)'
    condition: keywords

False Positives

3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185

References

Resolving title…

github.com

MITRE ATT&CK

Tactics

TA0001 · Initial Access TA0008 · Lateral Movement

Techniques

T1190 · Exploit Public-Facing Application T1210 · Exploitation of Remote Services

Rule Metadata

Rule ID

e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c

Status

test

Level

medium

Type

Detection

Created

Tue Jan 22

Modified

Sat Nov 27

Author

Florian Roth (Nextron Systems)

Path

rules/web/product/apache/web_apache_threading_error.yml

Raw Tags

attack.initial-accessattack.lateral-movementattack.t1190attack.t1210

View on GitHub