Nginx Core Dump

Title: Nginx Core Dump
Status: test
Description:Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
References:
  -https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
  -https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
Author: Florian Roth (Nextron Systems)
Date: 2021-05-31
modified:2023-05-08
Tags:

• -'attack.impact'
• -'attack.t1499.004'

Logsource:

• service: nginx

Detection:
  keywords:
    - 'exited on signal 6 (core dumped)'
  condition:keywords
Falsepositives:
  -Serious issues with a configuration or plugin
Level: high