NGINX - Core Dump

Back


Id	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
Rulename	NGINX - Core Dump
Description	Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
Version	1.0.3
Arm template	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec.json

KQL

NGINXHTTPServer
| where EventType =~ "ErrorLog"
| where EventMessage contains 'exited on signal 6 (core dumped)'
| extend ProcessIdCustomEntity = ProcessId

YAML

name: NGINX - Core Dump
id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
description: |
    'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: ProcessIdCustomEntity
    identifier: ProcessId
  entityType: Process
version: 1.0.3
triggerOperator: gt
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId  
tactics:
- Impact
kind: Scheduled
queryFrequency: 10m
severity: High
queryPeriod: 10m
requiredDataConnectors:
- dataTypes:
  - NGINX_CL
  connectorId: CustomLogsAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
relevantTechniques:
- T1499

ARM