NGINX - Core Dump

Back


Id	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
Rulename	NGINX - Core Dump
Description	Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Severity	High
Tactics	Impact
Techniques	T1499
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
Version	1.0.3
Arm template	9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec.json

KQL

NGINXHTTPServer
| where EventType =~ "ErrorLog"
| where EventMessage contains 'exited on signal 6 (core dumped)'
| extend ProcessIdCustomEntity = ProcessId

YAML

queryPeriod: 10m
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId  
name: NGINX - Core Dump
entityMappings:
- fieldMappings:
  - columnName: ProcessIdCustomEntity
    identifier: ProcessId
  entityType: Process
queryFrequency: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/NGINX HTTP Server/Analytic Rules/NGINXCoreDump.yaml
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - NGINX_CL
description: |
    'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'
kind: Scheduled
version: 1.0.3
status: Available
severity: High
relevantTechniques:
- T1499
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec

ARM