Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper
Flags gcc/c89/c99 executions that use -wrapper to invoke common shells with -s.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux process creation where the executed image path ends with /gcc, /c89, or /c99 and the command line includes the -wrapper option. It further matches command lines that invoke common shells using patterns like /bin/<shell>,-s (bash, dash, fish, sh, or zsh). This behavior is commonly used to run arbitrary commands or escape restricted environments, so correlating it with process creation telemetry helps surface suspicious shell-spawning activity.
Reporting behind it
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/gcc/#shell
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/c89/#shell
- gtfobins.github.iohttps://gtfobins.github.io/gtfobins/c99/#shell
- elastic.cohttps://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: GCC/C89/C99 Wrapper Executing Shell via -wrapper"
id: 4336b9b7-7233-4b7e-8f83-79b2e328ed5a
status: test
description: This rule identifies Linux process creation where the executed image path ends with /gcc, /c89, or /c99 and the command line includes the -wrapper option. It further matches command lines that invoke common shells using patterns like /bin/<shell>,-s (bash, dash, fish, sh, or zsh). This behavior is commonly used to run arbitrary commands or escape restricted environments, so correlating it with process creation telemetry helps surface suspicious shell-spawning activity.
references:
- https://gtfobins.github.io/gtfobins/gcc/#shell
- https://gtfobins.github.io/gtfobins/c89/#shell
- https://gtfobins.github.io/gtfobins/c99/#shell
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-09-02
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /c89
- /c99
- /gcc
CommandLine|contains: -wrapper
selection_cli:
CommandLine|contains:
- /bin/bash,-s
- /bin/dash,-s
- /bin/fish,-s
- /bin/sh,-s
- /bin/zsh,-s
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 9b5de532-a757-4d70-946c-1f3e44f48b4d
type: derived