shc simply wraps a shell script in C and turns it into a binary. As a result, if you monitor the kernel with tools like auditd or bpftrace, the shell script is still visible. I solved this by combining a shell interpreter (such as BusyBox) and the shell script into a single static binary.
Source: [Hacker News](https://github.com/HimitsuShell/HimitsuShell)