{"id":"e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c","title":"Apache Threading Error","description":"Detects an issue in apache logs that reports threading related errors","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-01-22","modified":"2021-11-27","tags":["attack.initial-access","attack.lateral-movement","attack.t1190","attack.t1210"],"technique_ids":["T1190","T1210"],"logsource":{"service":"apache","definition":"Requirements: Must be able to collect the error.log file"},"falsepositives":["3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185"],"references":["https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md"],"source_path":"rules/web/product/apache/web_apache_threading_error.yml","source_sha256":"257c6414b97175c93fc6de83b00b1efc8c2e281c788676bae7c589cc16fdecc5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/product/apache/web_apache_threading_error.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Apache Threading Error\nid: e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c\nstatus: test\ndescription: Detects an issue in apache logs that reports threading related errors\nreferences:\n    - https://github.com/hannob/apache-uaf/blob/da40f2be3684c8095ec6066fa68eb5c07a086233/README.md\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-01-22\nmodified: 2021-11-27\ntags:\n    - attack.initial-access\n    - attack.lateral-movement\n    - attack.t1190\n    - attack.t1210\nlogsource:\n    service: apache\n    definition: 'Requirements: Must be able to collect the error.log file'\ndetection:\n    keywords:\n        - '__pthread_tpp_change_priority: Assertion `new_prio == -1 || (new_prio >= fifo_min_prio && new_prio <= fifo_max_prio)'\n    condition: keywords\nfalsepositives:\n    - 3rd party apache modules - https://bz.apache.org/bugzilla/show_bug.cgi?id=46185\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1210","id":"T1210","name":"Exploitation of Remote Services","page":"techniques/enterprise/T1210/"}],"data_path":"data/detection-rules/e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c.json","kind":"sigma"}