Analytic detects GCC-based invocations that build shared objects with initialization functions, a technique commonly associated with Linux local privilege escalation and persistence. The rule ingests Linux endpoint telemetry (Sysmon for Linux EventID 1) and searches for process_name patterns indicative of compiler activity (e.g., "*x86_64-linux-gnu-gcc*", "cc", "g++", "gcc-*", "gcc") while also flagging commands that suggest building or loading shared objects (Processes.process contains "*-shared*", "*-Wl,-init,*", or "*.so*"). The detection aggregates by process and parent process metadata (name, path, GUID, IDs, user, etc.) and uses CIM-normalized fields to enable cross-source correlation. The intent is to surface suspicious build steps that create init routines in shared libraries, which can be leveraged for privilege escalation, post-exploitation, or persistence on Linux hosts. The rule includes implementation notes for ingesting EDR data mapped to the Endpoint data model, with a recommended false-positive caveat: legitimate developers may compile shared objects for legitimate purposes; filtering by trusted environments and users mitigates noise. References include CVE-2025-32463 and related advisories, and mappings reference MITRE techniques such as T1129, T1068, T1608, and T1027.004.