Behavioral threat detection definition and compilation

A system comprising:

• at least one processor;
• and
• memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operations, the set of operations comprising:
• encountering a first instruction of a behavior rule indicating at least one event and a parameter for the at least one event, wherein the at least one event is associated with a behavior;
• in response to encountering the first instruction, pausing execution of the behavior rule;
• when an event occurrence associated with the at least one event is identified at a computing device and the event occurrence associated with the at least one event indicates that an event having the parameter indicated by the first instruction occurred, resuming execution of the behavior rule;
• processing, based on a second instruction of the behavior rule, information associated with the event occurrence;
• encountering a third instruction of the behavior rule, wherein the third instruction is a halt instruction indicating a determination as to the behavior has been made;
• and
• performing, by the computing device, an action in response to the halt instruction.

A method for executing a behavior rule to perform behavioral threat detection, comprising:

• encountering a first instruction of a behavior rule indicating at least one event, wherein the at least one event is associated with a behavior;
• in response to encountering the first instruction, pausing execution of the behavior rule;
• when an event occurrence associated with the at least one event is identified, resuming execution of the behavior rule;
• processing, based on a second instruction of the behavior rule, information associated with the event occurrence;
• encountering a third instruction of the behavior rule, wherein the third instruction is a halt instruction indicating a determination as to the behavior has been made;
• and
• performing, by the system, an action in response to the halt instruction.