Detection: Linux Compiled C Source To Tmp

Description

The following analytic detects a C/C++ compiler compiling a C source file with the output binary written to /tmp, executed as a non-root user. This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running kernel's symbol offsets.

Search

 1`sysmon`
 2EventID=1
 3process_name IN (
 4    "*clang*",
 5    "*g++*",
 6    "*gcc*",
 7    "cc",
 8    "cc1",
 9    "cc1plus",
10    "tcc"
11)
12process IN (
13    "*.c *",
14    "*.c",
15    "*.c++",
16    "*.cc*",
17    "*.cpp*",
18    "*.cxx*"
19)
20
21User!="root"
22
23
24| regex process="(?i)(?:^
25|\s)(?:-o
26|--output)(?:\s+
27|\=)[\x22\x27]?(?:\/tmp
28|\/var\/tmp
29|\/dev\/shm)(?:\/[^\/\\\s\x00\x22\x27\>\<\
30|\:\&]+){0,}\/[^\/\\\s\x00\x22\x27\>\<\
31|\:\&\.]+(?:\s
32|\x22
33|\;
34|\x27
35|$)"
36
37
38| fillnull
39
40
41| stats count min(_time) as firstTime
42              max(_time) as lastTime
43
44  BY process_name process User dest
45
46
47| rename User as user
48
49
50| `security_content_ctime(firstTime)`
51
52| `security_content_ctime(lastTime)`
53
54| `linux_compiled_c_source_to_tmp_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon for Linux EventID 1	Linux	'sysmon:linux'	'Syslog:Linux-Sysmon/Operational'

Macros Used

Annotations

CVE

• CVE-2026-74580

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting Sysmon for Linux EventID 1 (process creation) logs with the process name, command line, user, and host fields extracted. You can use the Add-on for Linux Sysmon from Splunkbase. The search relies on the sysmon macro, which must match your Sysmon for Linux data.

Known False Positives

Developers compiling C code that outputs to /tmp. Filter by user to exclude known developer accounts.

Associated Analytic Story

• Linux Living Off The Land

• Linux Privilege Escalation

• Compromised Linux Host

Intermediate Findings

Threat Objects

References

• https://www.cve.org/CVERecord?id=CVE-2026-74580

• https://attack.mitre.org/techniques/T1068/

• https://attack.mitre.org/techniques/T1027/004/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1