Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
3
Platforms
3
Products / Services
3
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.
This rule detects a high volume (10 or more within an hour) of process creations where the command line contains 'compiler' or 'build'. This could indicate development activity, but also potentially malicious compilation or staging of tools by an attacker.