Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Linux Auditd Service Crash and Restart Burst

This analytic detects repeated Linux process crash events followed by repeated successful executions of the same executable on the same host within 10 seconds. A rapid crash and restart pattern in a service process…

Description

This analytic detects repeated Linux process crash events followed by repeated successful executions of the same executable on the same host within 10 seconds. A rapid crash and restart pattern in a service process can indicate exploitation attempts or unstable application behavior and should be correlated with network and application telemetry.

Detection logic

Detection requirements

Platform
IaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_syscall

Known benign triggers

  • Application defects, resource pressure, and supervisor restart policies can produce repeated crashes and restarts. Review the affected executable, user, parent process, host role, and related application or network activity. Tune thresholds or exclude expected workloads with the filter macro.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice