Shell Execution via GCC Wrapper - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•2•0•27

Detects the use of GCC (or C89/C99) with the '-wrapper' option to execute a shell, which can be leveraged for privilege escalation, unauthorized command execution, or to break out from restricted environments. This technique is often documented in resources like GTFOBins.