Identifier / Programs / Linux and Unix
c99
Compile C programs according to the ISO C standard. tldr-pages
GTFOBins file-read, file-write, shell 1 Sigma rule name it 1 ATT&CK technique 4 documented commands
How c99 is abused
file-read
-x-Efile-write
-x-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
-wrapperEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for c99.
4 documented commands
GTFOBins documents c99 with the commands of gcc.
file-read unprivileged, with sudo
gcc -x c -E /path/to/input-fileTrips no Sigma process-creation rule.
file-read unprivileged, with sudo
The file is read and parsed as a list of files (one per line), the content is displayed as error messages.
gcc @/path/to/input-fileTrips no Sigma process-creation rule.
file-write unprivileged, with sudo
This actually deletes the file.
gcc -x c /dev/null -o /path/to/input-fileTrips no Sigma process-creation rule.
shell unprivileged, with sudo
In some older versions, the x argument must instead reference any existing file.
gcc -wrapper /bin/sh,-s xTrips 1 Sigma rule: highShell Execution GCC - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
1 of the 4 commands the identifier reads trips a Sigma process-creation rule; 3 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for c99. The identifier reads the line of each that runs gcc.
What detects it
Everyday use
Compile source file(s) and create an executable
c99 file.cIdentifyCompile source file(s) and specify the executable output filename
c99 -o executable_name file.cIdentifyCompile source file(s) and create object file(s)
c99 -c file.cIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.