NGINX - Core Dump

Back


Id	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
Rulename	NGINX - Core Dump
Description	Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
Version	1.0.3
Arm template	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec.json

KQL

NGINXHTTPServer
| where EventType =~ "ErrorLog"
| where EventMessage contains 'exited on signal 6 (core dumped)'
| extend ProcessIdCustomEntity = ProcessId

YAML

id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
queryFrequency: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
queryPeriod: 10m
status: Available
name: NGINX - Core Dump
triggerThreshold: 0
relevantTechniques:
- T1499
kind: Scheduled
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - NGINX_CL
severity: High
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId  
entityMappings:
- fieldMappings:
  - identifier: ProcessId
    columnName: ProcessIdCustomEntity
  entityType: Process
tactics:
- Impact
version: 1.0.3
triggerOperator: gt
description: |
    'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'

ARM