Linux Compiled C Source To Tmp

The following analytic detects a C/C++ compiler compiling a C source file with the output binary written to /tmp, executed as a non-root user. This is a compile-after-delivery privilege escalation pattern. Kernel exploit PoCs and local privilege escalation tools commonly drop a C source file use compilers at runtime to produce a platform-specific binary in /tmp. This avoids architecture mismatches and allows the exploit to adapt to the running kernel's symbol offsets.