Detection: PHP Worker Segmentation Fault After Multipart POST

 1(
 2    `apache_access_logs` OR `apache_error_logs`
 3)
 4(
 5    (http_content_type="multipart/form-data*" AND http_method=POST)
 6    OR error_message="*exit signal Segmentation fault*"
 7)
 8
 9
10| rex field=error_message "child\s+pid\s+(?<child_pid>\d+)"
11
12
13| rex field=_raw "client\:?\s+(?<client>.*?)(?:,
14|\]
15|$)"
16
17| rex mode=sed field=client "s/\:\d+$//g"
18
19
20| eval pid=coalesce(child_pid,process_id,pid)
21
22| eval message=coalesce(error_message,message)
23
24| eval src=coalesce(client,src,src_ip)
25
26| eval dest=coalesce(server,dest,dest_ip)
27
28| eval uri_query=coalesce(uri_query,"")
29
30| eval uri_path=coalesce(uri_path,"")
31
32| eval uri=coalesce(uri_path.uri_query,uri)
33
34
35| stats count min(_time) as firstTime last(_time) as lastTime
36    dc(source) as dc_source
37    values(source) as source
38    dc(sourcetype) as dc_sourcetype
39    values(sourcetype) as sourcetype
40    values(http_method) as http_method
41    values(src) as src
42    values(dest) as dest
43    values(dest_port) as dest_port
44    values(site) as site
45    values(uri) as uri
46    values(url) as url
47    values(status) as status
48    values(memory_bytes) as memory_bytes
49    values(http_content_length) as http_content_length
50    values(http_content_type) as http_content_type
51    values(http_referrer) as http_referrer
52    values(http_user_agent) as http_user_agent
53    values(message) as message
54    by pid host
55
56| where dc_sourcetype>1
57
58
59| `security_content_ctime(firstTime)`
60
61| `security_content_ctime(lastTime)`
62
63| `php_worker_segmentation_fault_after_multipart_post_filter`