This Linux-focused analytic detects a compile-after-delivery privilege escalation pattern: a non-root user invokes a C/C++ compiler (clang, g++, gcc, cc, cc1, cc1plus, tcc) to compile a C source file and writes the resulting binary to /tmp. Adversaries and PoCs drop a C source file at runtime to build a platform-specific binary in /tmp, allowing adaptation to the host kernel and circumventing architecture offsets. The rule relies on Sysmon for Linux EventID 1 (process creation) data, filtering on compiler process names and C-source file patterns, and requiring the command line to reference /tmp. It further constrains the signal to non-root users. The detection aggregates results by process_name, process, and user, then renames User to user for reporting and applies time normalization. It is supplemented by a linux_compiled_c_source_to_tmp_filter macro to enforce the specific predicate. The rule links to MITRE T1068 (Privilege Escalation) and T1027.004 (Compile-after-delivery) and references CVE-2026-74580. Intermediate findings surface when a destination in /tmp is targeted and the executing user is identified, enabling drill-down into affected hosts and users. The analytic story classifies the pattern under Linux Privilege Escalation, Living Off The Land, and Compromised Linux Host. Known false positives include legitimate developers compiling to /tmp; filtering by known developer accounts mitigates this. The rule supports risk and alerting workflows through predefined drilldowns and is intended for Endpoint detection on Linux hosts.