This rule detects the first-time occurrence of a segmentation fault or access violation in internet-facing web servers by analyzing error logs from common web servers (Nginx, Apache, and Apache Tomcat). Implemented as a new_terms rule, it flags a host’s first observed crash within the configured history window as potentially indicative of an attempted memory-safety vulnerability exploitation. The rule searches web server error indices (logs-apache.error-*, logs-nginx.error-*, logs-apache_tomcat.catalina-*, logs-apache_tomcat.localhost-*) for signals such as segfault, SIGSEGV, phrases like Segmentation fault, 0xc0000005, or similar memory-access violation indicators. It focuses on newly observed terms (e.g., a new agent.id) within the last seven days to reduce noise from known or expected stability issues. While a web server crash can be caused by legitimate defects, configuration changes, or load tests, the alert highlights incidents that merit triage due to potential exploitation attempts or memory-corruption risks. The rule captures context around the crash (host, process, signal, affected module, and surrounding error text) and suggests investigation paths, including correlating with recent deployments, core dumps, and related anomalies. It maps to MITRE ATT&CK techniques (T1499/TA0040, T1190/Tactic: Initial Access and Impact) to aid in prioritization and has remediation guidance to isolate affected services, patch components, rotate credentials, and verify edge defenses. The rule emphasizes preserving evidence and correlating across peers to identify repeatable patterns or targeted campaigns.