Unusual Compliance/Audit Command-Line Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects an unusual frequency of command-line executions containing the terms 'compliance' or 'audit' on a single computer within a one-hour window. This activity could indicate an adversary performing reconnaissance or discovery to understand system configurations, security policies, or auditing mechanisms.