Linux Auditd Service Crash and Restart Burst

This analytic detects repeated Linux process crash events followed by repeated successful executions of the same executable on the same host within 10 seconds. A rapid crash and restart pattern in a service process can indicate exploitation attempts or unstable application behavior and should be correlated with network and application telemetry.