HTTP/2 Bomb: Remote DoS Detection and Hardening for NGINX, Apache, and IIS

---
title: Linux Web Server Process Crash (HTTP/2 Bomb Indicator)
id: 8a4c2d1e-9f3a-4b5c-8e6d-7f1a9b2c3d4e
status: experimental
description: Detects unexpected termination or restart of common web server processes (nginx/apache) which may indicate a DoS event like HTTP/2 Bomb.
references:
  - https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.impact
  - attack.t1499
logsource:
  service: syslog
detection:
  selection:
    program|contains:
      - 'nginx'
      - 'httpd'
      - 'apache2'
    message|contains:
      - 'exited'
      - 'terminated'
      - 'segfault'
      - 'panic'
  condition: selection
falsepositives:
  - Legitimate administrator restarting services
  - Planned maintenance
level: high
---
title: IIS Worker Process Unexpected Termination
id: 3b5d6e7f-1a2b-3c4d-5e6f-7a8b9c0d1e2f
status: experimental
description: Detects unexpected termination of the IIS worker process (w3wp.exe) often associated with resource exhaustion attacks.
references:
  - https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7031
    provider_name: 'Service Control Manager'
    message|contains:
      - 'World Wide Web Publishing Service'
      - 'IIS'
  condition: selection
falsepositives:
  - Manual IIS reset
  - System instability unrelated to attack
level: high
---
title: High Volume HTTP/2 Traffic on Standard Web Ports
id: 9c8d7e6f-5a4b-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Identifies suspicious spikes in TCP connections on port 443 which may characterize a flooding or protocol attack vector.
references:
  - https://thehackernews.com/2026/06/new-http2-bomb-vulnerability-allows.html
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort: 443
  filter:
    Initiated: 'false'
  timeframe: 1m
  condition: selection | count() > 1000
falsepositives:
  - High load legitimate traffic events
  - Scalability testing
level: medium

// Hunt for Linux Web Server Crashes via Syslog
Syslog
| where Facility in ('daemon', 'syslog')
| where ProcessName has_any ("nginx", "httpd", "apache2")
| where SyslogMessage has_any ("exited with status", "segfault", "core dump", "fatal error")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| extend RenderedDescription = SyslogMessage
| sort by TimeGenerated desc


// Hunt for IIS Worker Process Recycles/Crashes (WAS Event Log)
Event
| where EventLog == "WAS"
| where EventID in (5002, 5009, 5011) // Process termination events
| project TimeGenerated, Computer, EventID, RenderedDescription
| sort by TimeGenerated desc

-- Hunt for web server processes that have recently started (indicating a crash/restart loop)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name IN ('nginx', 'apache2', 'httpd', 'w3wp.exe')
  AND CreateTime < now() - timedelta(minutes=5)
ORDER BY CreateTime DESC

#!/bin/bash
# Backup and disable HTTP/2 in NGINX and Apache

echo "[*] Searching for NGINX HTTP/2 configurations..."
find /etc/nginx -name "*.conf" -type f -exec grep -l "http2" {} \; | while read file; do
    echo "Disabling HTTP/2 in $file"
    cp "$file" "$file.bak_$(date +%Y%m%d_%H%M%S)"
    sed -i 's/http2/#http2_disabled/g' "$file"
done

echo "[*] Searching for Apache HTTP/2 configurations..."
find /etc/apache2 -name "*.conf" -type f -exec grep -l "Protocols h2" {} \; | while read file; do
    echo "Disabling HTTP/2 in $file"
    cp "$file" "$file.bak_$(date +%Y%m%d_%H%M%S)"
    sed -i 's/Protocols h2/#Protocols h2_disabled/g' "$file"
done

echo "[*] Restarting services..."
systemctl restart nginx 2>/dev/null
systemctl restart apache2 2>/dev/null
systemctl restart httpd 2>/dev/null
echo "[*] Mitigation complete. Verify configuration syntax before production use."


**PowerShell (Windows - IIS):**

# Disable HTTP/2 on IIS via Registry
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\HTTP\Parameters"
$Name = "EnableHttp2"
$Value = 0

if (!(Test-Path $RegPath)) {
    New-Item -Path $RegPath -Force | Out-Null
}

try {
    Set-ItemProperty -Path $RegPath -Name $Name -Value $Value -Type DWord -Force
    Write-Host "[+] HTTP/2 has been disabled successfully." -ForegroundColor Green
    Write-Host "[!] Please restart the IIS service for changes to take effect." -ForegroundColor Yellow
    Restart-Service W3SVC -Force
}
catch {
    Write-Host "[-] Error modifying registry: $_" -ForegroundColor Red
}