Techniques
Sample rules
Linux Suspicious GCC Invocation Building Init Shared Object
- source: splunk
- technicques:
Description
The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime
FROM datamodel=Endpoint.Processes WHERE
Processes.process_name IN (
"*x86_64-linux-gnu-gcc*",
"cc",
"g++",
"gcc-*",
"gcc"
)
Processes.process="*-shared*"
Processes.process="*-Wl,-init,*"
Processes.process="*.so*"
BY Processes.action Processes.dest Processes.original_file_name
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_current_directory Processes.process_exec
Processes.process_guid Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name Processes.process_path
Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_suspicious_gcc_invocation_building_init_shared_object_filter`