LoFP LoFP / web-server, runtime, module, extension, or application defects can legitimately crash a worker after an upgrade, configuration change, or unusual request.

Techniques

Sample rules

First Occurrence of a Web Server Segmentation Fault

Description

This rule identifies the first segmentation fault, SIGSEGV, signal 11 termination, or Windows access-violation status observed in web-server error logs for a host during the configured history window. An unexpected web-server crash can indicate attempted exploitation of a memory-safety vulnerability, including attempts that fail before code execution, although software defects and resource problems can produce the same behavior.

Detection logic

agent.id:* and
event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:(
  segfault or SIGSEGV or (Segmentation and fault) or (signal and 11) or "0xc0000005" or "c0000005" or "3221225477"
)