NGINX - Core Dump

Status: available
Severity: high
Time window: 10m
Source: github.com/Azure/Azure-Sentinel

'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1499` Endpoint Denial of Service

Rule body

id: 9a7f5a97-354b-4eac-b407-a1cc7fc4b4ec
name: NGINX - Core Dump
description: |
  'Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: CustomLogsAma
    dataTypes:
      - NGINX_CL
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Impact
relevantTechniques:
  - T1499
query: |
  NGINXHTTPServer
  | where EventType =~ "ErrorLog"
  | where EventMessage contains 'exited on signal 6 (core dumped)'
  | extend ProcessIdCustomEntity = ProcessId
entityMappings:
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: ProcessIdCustomEntity
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

NGINXHTTPServer

Stage 2: `where`

| where EventType =~ "ErrorLog"

Stage 3: `where`

| where EventMessage contains 'exited on signal 6 (core dumped)'

Stage 4: `extend`

| extend ProcessIdCustomEntity = ProcessId

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventMessage`	contains	`exited on signal 6 (core dumped)`	`field:"EventMessage" kind:contains value:"exited on signal 6 (core dumped)"`
`EventType`	eq	`ErrorLog`	`field:"EventType" kind:eq value:"ErrorLog"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ProcessIdCustomEntity`	`extend`