Linux GCC Invocation Used to Execute Shell Scripts via -wrapper

title: Linux GCC Invocation Used to Execute Shell Scripts via -wrapper
id: 4336b9b7-7233-4b7e-8f83-79b2e328ed5a
status: test
description: This rule identifies Linux process executions where the image path ends with gcc, c89, or c99 and the command line includes the -wrapper option. It further matches when the command line contains shell invocations using /bin/bash,-s, /bin/dash,-s, /bin/fish,-s, /bin/sh,-s, or /bin/zsh,-s. Such behavior can enable attackers to run arbitrary commands or attempt shell breakout from constrained environments. The detection relies on Linux process creation telemetry with Image and CommandLine fields.
references:
  - https://gtfobins.github.io/gtfobins/gcc/#shell
  - https://gtfobins.github.io/gtfobins/c89/#shell
  - https://gtfobins.github.io/gtfobins/c99/#shell
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /c89
      - /c99
      - /gcc
    CommandLine|contains: -wrapper
  selection_cli:
    CommandLine|contains:
      - /bin/bash,-s
      - /bin/dash,-s
      - /bin/fish,-s
      - /bin/sh,-s
      - /bin/zsh,-s
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9b5de532-a757-4d70-946c-1f3e44f48b4d
    type: derived