High Volume of Compiler/Build Process Creation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.