GenAI Process Compiling or Generating Executables

  1[metadata]
  2creation_date = "2025/12/04"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when GenAI tools spawn compilers or packaging tools to generate executables. Attackers leverage local LLMs to
 11autonomously generate and compile malware, droppers, or implants. Python packaging tools (pyinstaller, nuitka, pyarmor)
 12are particularly high-risk as they create standalone executables that can be deployed without dependencies. This rule
 13focuses on compilation activity that produces output binaries, filtering out inspection-only operations.
 14"""
 15from = "now-9m"
 16index = [
 17    "logs-endpoint.events.process-*",
 18    "logs-windows.sysmon_operational-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21    "logs-auditd_manager.auditd-*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "GenAI Process Compiling or Generating Executables"
 26note = """## Triage and analysis
 27
 28### Investigating GenAI Process Compiling or Generating Executables
 29
 30This rule detects GenAI tools spawning compilers or packaging tools. While developers may use GenAI to write code that they then compile, autonomous compilation by GenAI processes is unusual.
 31
 32### Possible investigation steps
 33
 34- Review the GenAI process that spawned the compiler to identify which tool is running and verify if it's an expected/authorized tool.
 35- Investigate the user account associated with the GenAI process to determine if this activity is expected for that user.
 36- Review the output files created by the compilation process to identify any malicious executables.
 37- Check for other alerts or suspicious activity on the same host around the same time.
 38- Verify if the GenAI tool is from a trusted source and if it's authorized for use in your environment.
 39- Identify whether the generated executables appear in temporary directories often used for malware staging (`%TEMP%`, `/tmp`, `.cache`).
 40- Inspect the compiled artifacts for networking imports, credential harvesting functionality, or persistence mechanisms.
 41
 42### False positive analysis
 43
 44- Legitimate development workflows that use GenAI tools for code generation may trigger this rule if they compile the generated code.
 45- Some GenAI-assisted coding IDEs (Cursor, Copilot Workspace) may run compilation tasks when testing code; confirm whether the behavior is tied to developer workflow.
 46
 47### Response and remediation
 48
 49- Terminate the GenAI process and any spawned compiler processes to stop the malicious activity.
 50- Investigate the compiled executables to determine if they are malicious.
 51- Review audit logs to determine the scope of compilation activity and identify any executables that may have been created.
 52- Quarantine any compiled binaries; submit suspicious artifacts to sandbox or malware analysis.
 53"""
 54references = [
 55    "https://atlas.mitre.org/techniques/AML.T0053",
 56    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 57]
 58risk_score = 47
 59rule_id = "b2c3d4e5-f6a7-8901-bcde-f123456789ab"
 60severity = "medium"
 61tags = [
 62    "Domain: Endpoint",
 63    "OS: Linux",
 64    "OS: macOS",
 65    "OS: Windows",
 66    "Use Case: Threat Detection",
 67    "Tactic: Execution",
 68    "Tactic: Defense Evasion",
 69    "Data Source: Elastic Defend",
 70    "Data Source: Sysmon",
 71    "Data Source: Auditd Manager",
 72    "Data Source: Microsoft Defender XDR",
 73    "Data Source: SentinelOne",
 74    "Resources: Investigation Guide",
 75    "Domain: LLM",
 76    "Mitre Atlas: T0053",
 77    "Noise: Medium",
 78    "Performance: Normal",
 79    "Profile: Recommended",
 80    "Threat: Unauthorized AI Usage",
 81    "Rule Type: Event Correlation (EQL)",
 82    "Platform: Windows",
 83    "Platform: Linux",
 84    "Platform: macOS",
 85    "Domain: GenAI",
 86]
 87timestamp_override = "event.ingested"
 88type = "eql"
 89
 90query = '''
 91process where event.type == "start" and
 92
 93  // GenAI parent process
 94  (
 95    process.parent.name in (
 96      "ollama.exe", "ollama", "Ollama",
 97      "textgen.exe", "textgen", "text-generation-webui.exe", "oobabooga.exe",
 98      "lmstudio.exe", "lmstudio", "LM Studio",
 99      "claude.exe", "claude", "Claude",
100      "cursor.exe", "cursor", "Cursor", "Cursor Helper", "Cursor Helper (Plugin)",
101      "copilot.exe", "copilot", "Copilot",
102      "codex.exe", "codex",
103      "Jan", "jan.exe", "jan", "Jan Helper",
104      "gpt4all.exe", "gpt4all", "GPT4All",
105      "gemini-cli.exe", "gemini-cli",
106      "genaiscript.exe", "genaiscript",
107      "grok.exe", "grok",
108      "qwen.exe", "qwen",
109      "koboldcpp.exe", "koboldcpp", "KoboldCpp",
110      "llama-server", "llama-cli"
111    ) or
112    
113    // Node/Deno with GenAI frameworks
114    (process.parent.name in ("node.exe", "node", "deno.exe", "deno") and
115     process.parent.command_line like~ ("*mcp-server*", "*@modelcontextprotocol*", "*langchain*", "*autogpt*", "*babyagi*", "*agentgpt*", "*crewai*", "*semantic-kernel*", "*llama-index*", "*haystack*")) or
116    
117    // Python with GenAI frameworks
118    (process.parent.name like~ "python*" and
119     process.parent.command_line like~ ("*langchain*", "*autogpt*", "*babyagi*", "*agentgpt*", "*crewai*", "*semantic-kernel*", "*llama-index*", "*haystack*"))
120  ) and
121
122  // Compilation tools
123  (
124    // Python packaging
125    process.name in ("pyinstaller", "py2exe", "cx_Freeze", "nuitka", "pyarmor", "pkg") or
126    
127    // C/C++ compilation with output
128    (process.name in ("gcc", "g++", "clang", "clang++", "cl.exe") and
129     process.command_line like~ "*-o *" and
130     process.command_line like~ ("*.c *", "*.c", "*.cpp *", "*.cpp", "*.cc *", "*.cc", "*.m *", "*.m") and
131     not process.command_line like~ "*git*") or
132    
133    // Go compilation
134    (process.name == "go" and process.args == "build") or
135    
136    // Rust compilation
137    (process.name == "cargo" and process.args == "build") or
138    (process.name == "rustc" and process.command_line like~ "*-o *") or
139    
140    // .NET compilation
141    process.name in ("csc.exe", "vbc.exe", "msbuild.exe") or
142    (process.name == "dotnet" and process.args == "build") or
143    
144    // Java compilation
145    process.name == "javac"
146  )
147'''
148
149
150[[rule.threat]]
151framework = "MITRE ATT&CK"
152
153[[rule.threat.technique]]
154id = "T1027"
155name = "Obfuscated Files or Information"
156reference = "https://attack.mitre.org/techniques/T1027/"
157
158[[rule.threat.technique.subtechnique]]
159id = "T1027.004"
160name = "Compile After Delivery"
161reference = "https://attack.mitre.org/techniques/T1027/004/"
162
163[rule.threat.tactic]
164id = "TA0005"
165name = "Defense Evasion"
166reference = "https://attack.mitre.org/tactics/TA0005/"
167
168[[rule.threat]]
169framework = "MITRE ATT&CK"
170
171[[rule.threat.technique]]
172id = "T1587"
173name = "Develop Capabilities"
174reference = "https://attack.mitre.org/techniques/T1587/"
175
176[[rule.threat.technique.subtechnique]]
177id = "T1587.001"
178name = "Malware"
179reference = "https://attack.mitre.org/techniques/T1587/001/"
180
181[rule.threat.tactic]
182id = "TA0042"
183name = "Resource Development"
184reference = "https://attack.mitre.org/tactics/TA0042/"