GitLab Ruby/Puma/Sidekiq repeated worker crashes on Linux (Onigmo regex RCE)
Detects repeated crashes of GitLab Ruby, Puma, Sidekiq, or bundle processes on Linux within a short time window. The detection looks for crash markers such as segfault, SIGSEGV, SIGABRT, or onigmo in the command line, which typically indicate exploitation attempts against Onigmo regex engine vulnerabilities.
Microsoft Sentinel (KQL)
