Renamed TinyCC (TCC) Compiler Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the execution of a renamed TinyCC (TCC) Compiler (tcc.exe) Attackers have been observed renaming tcc.exe to masquerade as legitimate Windows binaries (e.g., svchost.exe) to compile and execute malicious C code in memory, such as shellcode loaders. This technique was observed in Chrysalis backdoor attacks.

2026-02-03 00:00:00

None

8a7b9c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d

attack.defense-evasion attack.t1036.003 attack.execution attack.t1059 attack.t1027.004

Nextron Sigma feed only (private)