AI Tradecraft - Rapid Compilation Post-LLM Query (T1127.001)
Detects the rapid compilation of code via csc.exe, gcc.exe, or vbc.exe immediately following an outbound network connection to an LLM API (specifically api.openai.com), indicating AI-assisted malware generation on-the-fly. The rule joins network events showing a connection to OpenAI's API with process creation events for compilers within a two-minute window on the same device.
Microsoft Sentinel (KQL)
