AN0850
Analytic 0850
Windows
Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.
WinEventLog:Application
EventCode=1000
WinEventLog:Sysmon
EventCode=1
WinEventLog:System
EventCode=7031, 7034
[TimeWindow]
Time window between repeated service crashes or restarts (e.g., 5 crashes within 1 hour)
[TargetApplication]
Critical applications to monitor based on environment (e.g., web server, database, VPN)
AN0851
Analytic 0851
Linux
User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.
auditd:SYSCALL
Process segfault or abnormal termination after invoking vulnerable syscall sequence
journald:Application
Segfault or crash log entry associated with specific application binary
NSM:Flow
Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)
[CrashPattern]
Specific binary fault signature or stack trace identifiers unique to the application context
[ExploitSourceIP]
Suspect source IPs for correlation across requests and service failure timing
AN0852
Analytic 0852
macOS
Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.
macos:unifiedlog
Crash log entries for a process receiving malformed input or known exploit patterns
macos:unifiedlog
Unusual child process tree indicating attempted recovery after crash
[CrashSignature]
Binary crash hash or affected dylib for distinguishing malicious faults from benign ones
[InputVector]
File, IPC, or network-based input that may be triggering exploitation (e.g., PDF file, POST request)
AN0853
Analytic 0853
IaaS
Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.
AWS:CloudTrail
TerminateInstances
AWS:CloudWatch
Repeated crash pattern within container or instance logs
AWS:VPCFlowLogs
Large volume of malformed or synthetic payloads to application endpoints prior to failure
[CrashThreshold]
Number of repeated crashes or terminations observed before triggering alert
[ServiceID]
Cloud service name, workload, or container ID to scope alerting