T1027.004 Compile After Delivery
|Field ||Description |
|timestamp ||date timestamp as a string generated from a unix timestamp |
|fn ||program responsible for compiling |
|path ||path for the process event |
|arguments ||arguments used for the compilation |
WITH progs as (
reverse(split_part(reverse(process_events.path), '/', 1)) as fn,
fn = 'go' AND (
CONTAINS(arguments, 'build') OR CONTAINS(arguments, 'run')
) OR fn LIKE 'javac%'
OR fn LIKE 'gcc%'
OR fn LIKE 'clang%'
OR fn LIKE 'g++%'
OR fn LIKE 'lcc%'
OR fn LIKE 'icc%'
OR fn LIKE 'bcc%'
OR fn LIKE 'cc%'