LoFP / serious issues with a configuration or plugin

Techniques

• t1499
• t1499.004

Sample rules

Nginx Core Dump

• source: sigma
• technicques:
  • t1499
  • t1499.004

Description

Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.

Detection logic

condition: keywords
keywords:
- exited on signal 6 (core dumped)