Zig Build-Exe with GitHub Repository Interaction
This rule detects the execution of a process that attempts to build an executable using 'zig build-exe' and subsequently initiates a process with a command line containing 'https://github.com/nullclaw/nullclaw.git'. This could indicate an adversary building a malicious executable on a host and then attempting to download or interact with a malicious GitHub repository, potentially for further stages of an attack.
Microsoft Sentinel (KQL)
