Detects rapid crash and restart bursts of Linux services by analyzing Linux Auditd events. The rule looks for crash events (ANOM_ABEND or specific syscall patterns) followed by repeated successful executions of the same executable within a 10-second window on the same host. It ingests Linux Auditd data (SYSCALL, TYPE, EXECVE, PROCTITLE) via the Splunk Add-on for Unix and Linux, normalizes fields (exe/host), and derives event_type as crash or start. Using streamstats, it tracks crash_count and restart_count per host/exe within 10-second windows. A burst is flagged when crash_count >= 2 and restart_count >= 2, indicating potential exploitation attempts, persistent compromise, or unstable application behavior. The analytic is tied to MITRE ATT&CK technique T1499.004 and is designed for endpoint telemetry correlation with network/application data. Correlation helps distinguish legitimate restarts from malicious activity. False positives may arise from application defects, resource pressure, or supervisor restart policies; thresholds should be tuned or exceptions added as needed. The rule is endpoint/Linux-specific and leverages CIM-aligned field normalization to facilitate integration with other data sources.