LoFP LoFP / development, staging, and quality-assurance systems may generate frequent novel fatal errors during testing.

Techniques

Sample rules

First Occurrence of a PHP Fatal Error on a Web Server

Description

This rule identifies the first PHP fatal error observed on a web server during the configured history window. PHP fatal errors are not inherently malicious, but a newly observed fatal condition can indicate exploitation of a previously unseen application or PHP engine failure. The rule is intentionally generic so it can identify both known and novel exploit attempts that terminate PHP request processing.

Detection logic

agent.id:* and
event.dataset:(
  "apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost"
) and (
  message:(PHP and Fatal and error)
)