Identifier / Programs / Linux and Unix
gcc
Preprocess and compile C and C++ source files, then assemble and link them together. Part of GCC (GNU Compiler Collection). tldr-pages
GTFOBins file-read, file-write, shell 1 Sigma rule name it 2 ATT&CK techniques 4 documented commands
How gcc is abused
file-read
-x-Efile-write
-x-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
-wrapperEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gcc.
4 documented commands
file-read unprivileged, with sudo
gcc -x c -E /path/to/input-fileTrips no Sigma process-creation rule.
file-read unprivileged, with sudo
The file is read and parsed as a list of files (one per line), the content is displayed as error messages.
gcc @/path/to/input-fileTrips no Sigma process-creation rule.
file-write unprivileged, with sudo
This actually deletes the file.
gcc -x c /dev/null -o /path/to/input-fileTrips no Sigma process-creation rule.
shell unprivileged, with sudo
In some older versions, the x argument must instead reference any existing file.
gcc -wrapper /bin/sh,-s xTrips 1 Sigma rule: highShell Execution GCC - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
1 of the 4 commands the identifier reads trips a Sigma process-creation rule; 3 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gcc. The identifier reads the line of each that runs gcc.
What detects it
Everyday use
Compile multiple source files into an executable
gcc path/to/source1.c path/to/source2.c ... --output path/to/output_executableIdentifyActivate output of all errors and warnings
gcc path/to/source.c -Wall --output output_executableIdentifyShow common warnings, debug symbols in output, and optimize without affecting debugging
gcc path/to/source.c -Wall --debug -Og --output path/to/output_executableIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.