Apache HTTP Server HTTP/2 Vulnerability: Detection and Remediation Guide for 2026

---
title: Apache HTTP Server Suspicious Child Process Execution
id: 8f2c1a4e-7b3d-4e5f-a6c8-9d0e1f2a3b4c
status: experimental
description: Detects suspicious child processes spawned by Apache HTTP Server workers, indicating potential post-exploitation activity following remote code execution via the HTTP/2 vulnerability.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apache2'
      - '/httpd'
  selection_img:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/base64'
  condition: selection_parent and selection_img
falsepositives:
  - Legitimate administrative scripts executed by Apache for CGI or similar functionality
  - Health check or monitoring scripts that legitimately invoke shell commands
level: high
---
title: Apache Worker Process Network Connection to External Host
id: 3d7e9f2a-1b4c-4d5e-8f0a-2b3c4d5e6f7a
status: experimental
description: Detects Apache worker processes initiating outbound network connections to external IP addresses, which may indicate command-and-control communication or data exfiltration following exploitation.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/apache2'
      - '/httpd'
    DestinationIp|cidr:
      - '0.0.0.0/0'
  filter_localhost:
    DestinationIp:
      - '127.0.0.1'
      - '::1'
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_localhost and not filter_internal
falsepositives:
  - Legitimate outbound API calls made by web applications
  - Reverse proxy configurations where Apache legitimately connects to backend services
level: medium
---
title: Apache HTTP Server HTTP/2 Protocol Anomaly Detection
id: 5a1b3c7d-9e2f-4a6b-8c0d-4e5f6a7b8c9d
status: experimental
description: Detects anomalous HTTP/2 connection patterns in Apache access logs that may indicate exploitation attempts against the HTTP/2 module, including rapid stream creation, malformed frame sequences, or unusual protocol negotiation behavior.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    c-uri|contains:
      - 'h2c'
      - 'Upgrade: h2c'
  selection_status:
    sc-status:
      - '500'
      - '502'
      - '503'
      - '400'
  condition: selection or selection_status
falsepositives:
  - Legitimate HTTP/2 cleartext upgrade attempts
  - Application errors unrelated to exploitation
level: low

// Hunt for suspicious child processes spawned by Apache workers
let ApacheProcesses = dynamic(["apache2", "httpd"]);
let SuspiciousChildren = dynamic(["bash", "sh", "dash", "zsh", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "php", "base64", "chmod", "chown"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ (ApacheProcesses)
| extend CommandLine = tostring(SyslogMessage)
| where CommandLine has_any (SuspiciousChildren)
| project TimeGenerated, Computer, ProcessName, CommandLine, SeverityLevel
| order by TimeGenerated desc
;
// Hunt for outbound network connections from Apache processes to external IPs
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("apache2", "httpd")
| where RemoteIP !startswith "10." and RemoteIP !startswith "172." and RemoteIP !startswith "192.168."
| where RemoteIP != "127.0.0.1"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc
;
// Hunt for web shell indicators in Apache-accessible directories
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/var/www/", "/srv/www/", "/usr/local/apache2/", "/etc/apache2/")
| where FileName endswith ".php" or FileName endswith ".jsp" or FileName endswith ".asp" or FileName endswith ".aspx"
| where InitiatingProcessFileName in~ ("apache2", "httpd", "www-data")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for suspicious child processes of Apache workers
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ 'apache2|httpd'
)
AND (
    Name =~ 'bash|sh|dash|zsh|curl|wget|nc|ncat|python|python3|perl|php|base64'
    OR CommandLine =~ 'bash|sh|curl|wget|nc |python|perl|php|base64'
)

-- Hunt for recently modified files in web root directories
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=['/var/www/**/*.php', '/var/www/**/*.jsp', '/srv/www/**/*.php', '/usr/local/apache2/htdocs/**/*.php'])
WHERE Mtime > now() - 86400 * 7
ORDER BY Mtime DESC

-- Hunt for network connections established by Apache processes
SELECT Pid, Name, Status, LocalAddress, LocalPort, RemoteAddress, RemotePort
FROM netstat()
WHERE Name =~ 'apache2|httpd'
AND Status =~ 'ESTABLISHED'
AND RemoteAddress !~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|::1)'

#!/bin/bash
# Apache HTTP/2 Vulnerability - Verification and Remediation Script
# Run as root or with sudo

set -euo pipefail

echo "=== Apache HTTP/2 Vulnerability Assessment ==="
echo "Date: $(date)"
echo ""

# 1. Check Apache version
echo "[1] Checking Apache version..."
if command -v apache2ctl &> /dev/null; then
    APACHE_VERSION=$(apache2ctl -v 2>/dev/null | head -1)
    echo "    Found: $APACHE_VERSION"
elif command -v httpd &> /dev/null; then
    APACHE_VERSION=$(httpd -v 2>/dev/null | head -1)
    echo "    Found: $APACHE_VERSION"
else
    echo "    Apache not found on this system."
    exit 0
fi

# 2. Check if mod_http2 is loaded
echo ""
echo "[2] Checking if mod_http2 is loaded..."
if apache2ctl -M 2>/dev/null | grep -q "http2" || httpd -M 2>/dev/null | grep -q "http2"; then
    echo "    WARNING: mod_http2 is LOADED. This server may be vulnerable."
    HTTP2_LOADED=true
else
    echo "    OK: mod_http2 is not loaded. Risk is reduced but patching is still recommended."
    HTTP2_LOADED=false
fi

# 3. Check for HTTP/2 in configuration
echo ""
echo "[3] Checking Apache configuration for HTTP/2 directives..."
CONFIG_FILES=$(find /etc/apache2 /etc/httpd /usr/local/apache2/conf -name "*.conf" 2>/dev/null || true)
for conf in $CONFIG_FILES; do
    if grep -qi "Protocols.*h2\|H2Direct\|H2Push" "$conf" 2>/dev/null; then
        echo "    FOUND HTTP/2 directive in: $conf"
        grep -i "Protocols.*h2\|H2Direct\|H2Push" "$conf" 2>/dev/null | head -5
    fi
done

# 4. Attempt to update Apache
echo ""
echo "[4] Attempting to update Apache HTTP Server..."
if command -v apt-get &> /dev/null; then
    echo "    Using apt-get (Debian/Ubuntu)..."
    apt-get update -qq
    apt-get install --only-upgrade -y apache2 apache2-bin apache2-utils 2>/dev/null || \
    apt-get install --only-upgrade -y apache2 2>/dev/null || \
    echo "    WARNING: Could not update via apt-get. Check for held packages or broken dependencies."
elif command -v yum &> /dev/null; then
    echo "    Using yum (RHEL/CentOS)..."
    yum update -y httpd httpd-tools mod_http2 2>/dev/null || \
    yum update -y httpd 2>/dev/null || \
    echo "    WARNING: Could not update via yum."
elif command -v dnf &> /dev/null; then
    echo "    Using dnf (Fedora/RHEL 8+)..."
    dnf update -y httpd httpd-tools mod_http2 2>/dev/null || \
    dnf update -y httpd 2>/dev/null || \
    echo "    WARNING: Could not update via dnf."
else
    echo "    WARNING: No supported package manager found. Manual patching required."
fi

# 5. Restart Apache
echo ""
echo "[5] Restarting Apache service..."
if systemctl is-active --quiet apache2 2>/dev/null; then
    systemctl restart apache2
    echo "    apache2 service restarted."
elif systemctl is-active --quiet httpd 2>/dev/null; then
    systemctl restart httpd
    echo "    httpd service restarted."
else
    echo "    Apache service not found via systemctl. Manual restart may be required."
fi

# 6. Verify patch
echo ""
echo "[6] Verifying patched version..."
NEW_VERSION=$(apache2ctl -v 2>/dev/null | head -1 || httpd -v 2>/dev/null | head -1)
echo "    Current version: $NEW_VERSION"

echo ""
echo "=== Assessment Complete ==="
echo ""
echo "IMPORTANT: Verify that the updated Apache version includes the HTTP/2 security fix."
echo "Refer to the Apache HTTP Server security advisories at https://httpd.apache.org/security/"
echo ""
if [ "$HTTP2_LOADED" = true ]; then
    echo "ACTION REQUIRED: mod_http2 was loaded. Confirm the patch addresses the HTTP/2 vulnerability."
fi