Sunturai
Back to results
InformationalSplunk security contentOnur Mustafa Erdogan +3

PHP Worker Segmentation Fault After Multipart POST

This analytic pairs an Apache AH00051 worker segmentation-fault notice with the most recent logged request from that child PID on the same host and Apache instance. It looks for multipart POST requests within short…

Description

This analytic pairs an Apache AH00051 worker segmentation-fault notice with the most recent logged request from that child PID on the same host and Apache instance. It looks for multipart POST requests within short time frame around the crash, a pattern that can occur during PHP2Shell exploitation. Captured access event is a candidate for the associated request that leads to crash. Yet, request that kills the worker may never reach the access log.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
apache_access_logapache_error_log

Known benign triggers

  • Legitimate large multipart uploads, application bugs, or load tests can cause segmentation fault errors. Review the correlated access and PHP error events before classifying this activity as exploitation.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice