Loading story…
Splunk published a detection analytic for Linux systems that identifies suspicious compiler activity building shared objects with initialization functions, a pattern associated with post-exploitation, persistence, and privilege-escalation tradecraft. The analytic looks for gcc and related compiler processes using flags such as -shared and linker options matching -Wl,-init,* while producing .so output, and it references CVE-2025-32463 as a related concern. The rule is disabled by default, runs hourly when enabled, and depends on EDR or Sysmon for Linux process telemetry mapped into Splunk's Endpoint data model.
The behavior aligns with several MITRE ATT&CK techniques, including Shared Modules (T1129), Stage Capabilities (T1608), and Compile After Delivery (T1027.004). ATT&CK describes adversaries loading malicious functionality through shared libraries and dynamically resolving code at runtime, while staged capabilities can be hosted or prepared on attacker-controlled infrastructure before delivery. Splunk warned that legitimate software development can produce similar compiler activity, so defenders are advised to tune out trusted build workflows while prioritizing unexpected .so compilation with initialization routines on production or non-development Linux hosts.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its detection analytic "Linux Suspicious GCC Invocation Building Init Shared Object," which identifies compiler executions using flags such as "-shared" and "-Wl,-init,*" to build .so files with auto-run initialization functions. The analytic maps this behavior to multiple ATT&CK techniques and references CVE-2025-32463.
MITRE ATT&CK published the Enterprise technique page for Stage Capabilities (T1608), describing how adversaries stage malware, tools, web resources, and certificates on controlled or compromised infrastructure to support later operations.
MITRE ATT&CK published the Enterprise sub-technique page for Obfuscated Files or Information: Compile After Delivery (T1027.004). The reference provides a publication date but no additional event details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Splunk released a Linux anomaly detection analytic for suspicious staging of alternate system files associated with **CVE-2025-32463** (`chwoot`), a local privilege-escalation technique that abuses fake root directories and spoofed configuration files. The analytic looks for creation of sensitive files such as `passwd`, `shadow`, `sudoers`, `nsswitch.conf`, and `libnss` libraries outside expected locations, aiming to catch attempts to influence how privileged processes including `sudo` resolve name services. The detection uses Endpoint telemetry mapped to the Splunk CIM Filesystem data model and is designed to identify filesystem activity outside normal paths such as `/etc` and `/var/lib/docker`. Splunk said the analytic is disabled by default and generates intermediate risk events rather than direct notable alerts because legitimate development, testing, and container-related activity may trigger false positives. Separately, MITRE ATT&CK documents **Aoqin Dragon** (`G1007`) as a suspected Chinese cyber-espionage group targeting government, education, and telecommunications organizations in the Asia-Pacific region, though the reference does not tie the group directly to the `chwoot` detection.
Aug 12, 2026
Splunk has published a new analytic to detect exploitation of the Linux kernel local privilege escalation flaw known as **Dirty Frag**, tied to `CVE-2026-43284` and `CVE-2026-43500`. The detection maps to MITRE ATT&CK technique `T1548.001` for abuse of setuid and setgid mechanisms, and is designed to identify attackers escalating privileges from an unprivileged Linux process to root. The analytic looks for a distinctive exploit chain in Linux `auditd` telemetry: a burst of `splice()` or `vmsplice()` syscalls from a process launched from a user-writable path, followed within five minutes by execution of a **setuid** binary in the same audit session. Splunk said the detection is intended for Splunk Enterprise Security, is disabled by default, and requires Linux `auditd` data with audit rule keys for `splice_user` and `process_creation`; it also warned that high-I/O legitimate workloads may need tuning or allowlisting because the threshold was calibrated against the public V4bel proof of concept.
Jul 16, 2026
Security content from Elastic and Splunk highlights two Linux behaviors that defenders should monitor closely: unauthorized privilege escalation through `setuid` execution and deletion of web server access logs. Splunk published an anomaly detection for Linux `auditd` that flags `execve` syscall 59 events where a non-root user gains effective UID 0 without a matching successful PAM authentication event in the same audit session, a pattern associated with privilege escalation and mapped to MITRE ATT&CK `T1068`; the rule also references `CVE-2026-46331` and notes that some scheduled tasks can produce false positives. Elastic separately documented a prebuilt rule for detecting deleted web server access logs, while ThreatBear provided tuning guidance showing how legitimate activity on Mitel MiCollab systems can create noisy process trees and trigger alerts such as suspicious Java child processes and logfile deletion detections. The combined guidance underscores that Linux monitoring programs should pair coverage for high-risk behaviors with environment-specific exceptions so defenders can preserve visibility into real attacks without overwhelming analysts with benign alerts.
Jul 31, 2026