Detect abnormal process termination
This use case demonstrates how Wazuh detects processes that terminate unexpectedly. Abnormal process termination can indicate application crashes, exploitation attempts, memory corruption, or malicious attempts to terminate processes.
Ubuntu endpoint
Run the following command to intentionally trigger a segmentation fault:
# python3 -c "import ctypes; ctypes.string_at(0)"
The command terminates the Python process with a segmentation fault, causing the Linux Audit subsystem to generate an ANOM_ABEND audit event.
Navigate to Threat Intelligence > Threat Hunting > Findings on the Wazuh dashboard to view the generated finding:
