id: 2c646486-7a9c-5ba7-a7e1-61950d5272f6
name: PHP2Shell - Burst of PHP worker crashes
description: |
  'Five or more PHP-FPM or Apache worker crashes (signal 11, segmentation fault) on one server within ten minutes. Memory-corruption exploits such as CVE-2026-109619 often crash workers while they are being tuned.'
severity: Medium
requiredDataConnectors:
  - connectorId: SyslogAma
    dataTypes:
      - Syslog
queryFrequency: 15m
queryPeriod: 30m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Impact
relevantTechniques:
  - T1190
  - T1499.004
query: |
  // PHP2Shell (CVE-2026-109619): bursts of crashed PHP workers while an exploit is tried and tuned.
  // PHP-FPM logs "child ... exited on signal 11 (SIGSEGV)"; Apache logs "child pid ... exit signal Segmentation fault (11)" (AH00052).
  let Threshold = 5;
  Syslog
  | where SyslogMessage has "exited on signal 11" or SyslogMessage has "Segmentation fault"
  | where ProcessName has_any ("php", "apache", "httpd") or SyslogMessage has_any ("php-fpm", "AH00052")
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), Crashes = count(), Sample = take_any(SyslogMessage) by Computer, bin(TimeGenerated, 10m)
  | where Crashes >= Threshold
  | project StartTime, EndTime, Computer, Crashes, Sample
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
eventGroupingSettings:
  aggregationKind: AlertPerResult
version: 1.0.0
kind: Scheduled