sequence by host.id with maxspan=1m
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
process.name in ("gcc", "g++", "cc") and user.id != "0"] by process.args
[file where host.os.type == "linux" and event.action == "creation" and event.type == "creation" and
process.name == "ld" and user.id != "0"] by file.name
[process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
user.id != "0"] by process.name
[process where host.os.type == "linux" and event.action in ("uid_change", "guid_change") and event.type == "change" and
user.id == "0"] by process.name
Install detection rules in Elastic Security
Detect Potential Privilege Escalation via Recently Compiled Executable in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).