{"id":"59ec40bb-322e-40ab-808d-84fa690d7e56","title":"Nginx Core Dump","description":"Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-31","modified":"2023-05-08","tags":["attack.impact","attack.t1499.004"],"technique_ids":["T1499.004"],"logsource":{"service":"nginx"},"falsepositives":["Serious issues with a configuration or plugin"],"references":["https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps","https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/"],"source_path":"rules/web/product/nginx/web_nginx_core_dump.yml","source_sha256":"b3a03dbed72f5005d04dfc56e92a0504d4644c620982b44f886d53b8c741579d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/product/nginx/web_nginx_core_dump.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Nginx Core Dump\nid: 59ec40bb-322e-40ab-808d-84fa690d7e56\nstatus: test\ndescription: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.\nreferences:\n    - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps\n    - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-05-31\nmodified: 2023-05-08\ntags:\n    - attack.impact\n    - attack.t1499.004\nlogsource:\n    service: nginx\ndetection:\n    keywords:\n        - 'exited on signal 6 (core dumped)'\n    condition: keywords\nfalsepositives:\n    - Serious issues with a configuration or plugin\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1499.004","id":"T1499.004","name":"Application or System Exploitation","page":"techniques/enterprise/T1499.004/"}],"data_path":"data/detection-rules/59ec40bb-322e-40ab-808d-84fa690d7e56.json","kind":"sigma"}