AN1381
Analytic 1381
Windows
Detects compilation activity using csc.exe, ilasm.exe, or msbuild.exe initiated by user-space processes outside typical development environments, followed by execution or network activity from newly written binaries.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=3, 22
[ParentProcessName]
Filter for unexpected users (non-dev) launching compilers like csc.exe or msbuild.exe
[OutputDirectoryPath]
Adjust paths for sensitive file write zones (e.g., `C:\Users\Public\`, `%TEMP%`, or Desktop)
[TimeWindow]
Tune the correlation window between compilation and subsequent execution or C2
AN1382
Analytic 1382
Linux
Detects GCC or Clang invoked on suspicious file paths (e.g., /tmp/, ~/Downloads) with output to executable binaries, followed by execution or outbound traffic from these binaries.
auditd:SYSCALL
execve
auditd:SYSCALL
open,create
NSM:Flow
conn.log
[CompilerBinaryPath]
Specify path and binaries for detection (e.g., `/usr/bin/gcc`, `/opt/mingw/bin/gcc`)
[FilePermissionProfile]
Match uncommon chmod behavior post-compilation (e.g., +x in `/tmp` or home directories)
AN1383
Analytic 1383
macOS
Detects non-standard compilation activity via Xcode CLI tools or bundled GCC/MONO packages writing new executable files and executing them outside dev environments (e.g., user Downloads folder).
macos:unifiedlog
process activity, exec events
macos:osquery
file_events
macos:unifiedlog
networkd or socket
[CompilerInvocationPattern]
Detect calls to `xcodebuild`, `clang`, or `/Applications/Mono.app/...` from non-admin users
[OutputBinaryPath]
Monitor for output files in user-writable paths (e.g., `~/Library/Caches`, `~/Downloads`)