NGINX - Core Dump

Back


Id	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
Rulename	NGINX - Core Dump
Description	Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
Version	1.0.3
Arm template	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec.json

KQL

NGINXHTTPServer
| where EventType =~ "ErrorLog"
| where EventMessage contains 'exited on signal 6 (core dumped)'
| extend ProcessIdCustomEntity = ProcessId

YAML

name: NGINX - Core Dump
queryPeriod: 10m
queryFrequency: 10m
kind: Scheduled
id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
requiredDataConnectors:
- dataTypes:
  - NGINX_CL
  connectorId: CustomLogsAma
triggerOperator: gt
description: |
    'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
status: Available
entityMappings:
- entityType: Process
  fieldMappings:
  - identifier: ProcessId
    columnName: ProcessIdCustomEntity
triggerThreshold: 0
severity: High
version: 1.0.3
tactics:
- Impact
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId  
relevantTechniques:
- T1499

ARM