IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Anomalous Linux Compiler Activity
editAnomalous Linux Compiler Activity
editLooks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity.
Rule type: machine_learning
Rule indices: None
Severity: low
Risk score: 21
Runs every: 15m
Searches indices from: now-45m (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 100
References: None
Tags:
- Elastic
- Host
- Linux
- Threat Detection
- ML
- Machine Learning
- Resource Development
Version: 101
Rule authors:
- Elastic
Rule license: Elastic License v2
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Resource Development
- ID: TA0042
- Reference URL: https://attack.mitre.org/tactics/TA0042/
-
Technique:
- Name: Obtain Capabilities
- ID: T1588
- Reference URL: https://attack.mitre.org/techniques/T1588/
-
Sub-technique:
- Name: Malware
- ID: T1588.001
- Reference URL: https://attack.mitre.org/techniques/T1588/001/