Identifier / Programs / Linux and Unix
aptitude
Debian and Ubuntu package management utility. tldr-pages
GTFOBins inherit 1 documented command
How aptitude is abused
inherit
changelog
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for aptitude.
1 documented command
inherit unprivileged, with sudo
aptitude changelog aptitudeThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for aptitude. The identifier reads the line that runs aptitude.
Everyday use
Synchronize list of packages and versions available. This should be run first, before running subsequent aptitude commands
sudo aptitude updateIdentifyInstall a new package and its dependencies
sudo aptitude install packageIdentifySearch for a package
aptitude search packageIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.