Elastic Security Detection Rules

First Occurrence of a Web Server Segmentation Fault

Last updated 2 days ago on 2026-10-22
Created 2 days ago on 2026-10-22

About

This rule identifies the first segmentation fault, SIGSEGV, signal 11 termination, or Windows access-violation status observed in web-server error logs for a host during the configured history window. An unexpected web-server crash can indicate attempted exploitation of a memory-safety vulnerability, including attempts that fail before code execution, although software defects and resource problems can produce the same behavior.
Tags
Domain: WebUse Case: Threat DetectionTactic: Initial AccessTactic: ImpactData Source: NginxData Source: ApacheData Source: Apache TomcatRule Type: New TermsService: NginxService: Apache TomcatService: Apache HTTP ServerLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Endpoint Denial of Service (T1499)(external, opens in a new tab or window)

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Exploit Public-Facing Application (T1190)(external, opens in a new tab or window)

False Positive Examples
Web-server, runtime, module, extension, or application defects can legitimately crash a worker after an upgrade, configuration change, or unusual request. Stress tests, fault-injection exercises, fuzzing, and authorized vulnerability testing may intentionally trigger segmentation faults or access violations.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-apache.error-*logs-apache_tomcat.catalina-*logs-apache_tomcat.localhost-*logs-nginx.error-*
Related Integrations

nginx(external, opens in a new tab or window)

apache(external, opens in a new tab or window)

apache_tomcat(external, opens in a new tab or window)

Query
text code block:
agent.id:* and
event.dataset:("apache.error" or "nginx.error" or "apache_tomcat.catalina" or "apache_tomcat.localhost") and
message:(
  segfault or SIGSEGV or (Segmentation and fault) or (signal and 11) or "0xc0000005" or "c0000005" or "3221225477"
)

Install detection rules in Elastic Security

Detect First Occurrence of a Web Server Segmentation Fault in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).