Identifier / Programs / Linux and Unix
awk
A versatile programming language for working on files. tldr-pages
GTFOBins shell 3 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How awk is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for awk.
3 documented commands
GTFOBins documents awk with the commands of mawk.
file-read unprivileged, with sudo, as SUID
mawk '//' /path/to/input-fileTrips no Sigma process-creation rule.
file-write unprivileged, with sudo, as SUID
mawk 'BEGIN { print "DATA" > "/path/to/output-file" }'Trips no Sigma process-creation rule.
shell unprivileged, with sudo, as SUID
mawk 'BEGIN {system("/bin/sh")}'Trips 1 Sigma rule: highSuspicious Invocation of Shell via AWK - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for awk. The identifier reads the line of each that runs mawk.
What detects it
Everyday use
Print the fifth column (a.k.a. field) in a space-separated file
awk '{print $5}' path/to/fileIdentifyPrint the second column of the lines containing "string1" in a space-separated file
awk '/string1/ {print $2}' path/to/fileIdentifyPrint the last column of each line in a file, using a comma (instead of space) as a field separator
awk -F ',' '{print $NF}' path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.