Linux Suspicious GCC Invocation Building Init Shared Object — Detection Rule
The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.