Tiny C Compiler Runtime Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects execution of Tiny C Compiler (TCC) which compiles and executes C code directly in memory. This technique was observed in Chrysalis backdoor campaigns where attackers renamed tcc.exe to svchost.exe and used it to load shellcode from .c files directly into memory, bypassing traditional detection methods.

2026-02-03 00:00:00

None

8a3b5d2e-7f4c-4e9a-b1d6-3c8e5f2a9b4d

attack.defense-evasion attack.execution attack.t1059 attack.t1027.004

Nextron Sigma feed only (private)