Coverage › CVE-2019-0211
CVE-2019-0211 Mapped Sigma
Apache HTTP Server Privilege Escalation Vulnerability
- Vendor / product
- Apache — HTTP Server
- Description (CISA)
- Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
- Added to KEV
- 2021-11-03
- Due date
- 2022-05-03
- Required action
- Apply updates per vendor instructions.
- Known ransomware use
- Unknown
- CWE
- CWE-416
- CISA notes
- https://nvd.nist.gov/vuln/detail/CVE-2019-0211
- Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
1 mapping object across 1 technique. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1068 Exploitation for Privilege Escalation | exploitation technique | CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server with MPM event, worker, or prefork that allows an attacker to execute code with the privileges of that parent process (usually root). ref 1 · ref 2 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1068 Exploitation for Privilege Escalation exploitation technique
- DET0514 Detection Strategy for Exploitation for Privilege Escalation
AN1419 WindowsDetects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.Tunable:
DriverNamePatternTimeWindowParentProcessPathAN1420 LinuxDetects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.Tunable:SetUIDBinaryListTimeWindowEffectiveUIDThresholdAN1421 macOSDetects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.Tunable:EntitlementListTimeWindowAN1422 ContainersDetects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.Tunable:NamespaceEscapePatternTimeWindow
Sigma rules tagged attack.t1068 (31)
Author: Florian Roth (Nextron Systems)
· 2019-11-20 (modified 2024-12-01) · logsource: product=windows category=process_creation · 02e0b2ea-a597-428e-b04a-af6a1a403e5c
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-18 (modified 2023-12-02) · logsource: product=windows category=driver_load · 05296024-fe8a-4baf-8f3d-9a5f5624ceb2
Detects loading of known malicious drivers via their hash.
Author: Florian Roth (Nextron Systems)
· 2021-10-09 (modified 2022-12-25) · logsource: product=linux service=auditd · 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
Detects command line parameter very often used with coin miners
Author: Nisarg Suthar
· 2025-08-01 · logsource: product=windows category=process_creation · 0fdc7c7f-c690-4217-9ae3-31f5156eed72
Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
· 2025-10-02 (modified 2026-03-31) · logsource: product=linux category=file_event · 10ac0730-c24e-4f4c-81f8-b13a1ac95a1d
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.
Author: @eyezuhk Isaac Fernandes
· 2025-02-19 · logsource: product=windows category=image_load · 17ce9373-2163-4a2c-90ba-f91e9ef7a8c1
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Author: Florian Roth (Nextron Systems)
· 2017-03-01 (modified 2025-03-17) · logsource: product=linux · 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
Detects buffer overflow attempts in Unix system log files
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
· 2019-11-15 (modified 2021-11-27) · logsource: product=windows category=process_creation · 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-06 · logsource: product=windows category=process_creation · 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-03 (modified 2023-12-02) · logsource: product=windows category=driver_load · 39b64854-5497-4b57-a448-40977b8c9679
Detects loading of known malicious drivers via the file name of the drivers.
Author: Florian Roth (Nextron Systems)
· 2021-11-22 (modified 2022-12-25) · logsource: product=windows category=file_event · 3be82d5d-09fe-4d6a-a275-0d40d234d324
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file
Author: Gene Kazimiarovich
· 2026-04-30 · logsource: product=linux service=auditd · 474b415a-8b3d-4e6a-9f12-0d5c8a7b6e94
Detects creation of AF_ALG (Address Family 38) sockets via the socket() syscall.
AF_ALG is the Linux kernel crypto API interface. It is exploited in CVE-2026-31431
to achieve local privilege escalation via a buffer overflow in the AF_ALG AEAD
splice path that corrupts the page cache of SUID binaries.
Legitimate AF_ALG usage is rare and confined to specific crypto utilities and VPN
daemons using non-default kernel offload configurations.
Author: Gene Kazimiarovich
· 2026-05-09 · logsource: product=linux category=process_creation · 474b415a-d917-4f3b-8c62-9e1a0d5f7b48
Detects kernel auto-loading of the authencesn crypto module via modprobe
This occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher
(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the
crypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,
where the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,
corrupting the page cache of SUID binaries for local privilege escalation.
On Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)
with 'modprobe' appearing in the command line.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.