Identifier / Programs / Linux and Unix
bpftrace
High-level tracing language for Linux eBPF. tldr-pages
GTFOBins shell 1 ATT&CK technique 3 documented commands
How bpftrace is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
--unsafeEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for bpftrace.
3 documented commands
shell with sudo
bpftrace --unsafe -e 'BEGIN {system("/bin/sh 1<&0");exit()}'Trips 1 Sigma rule: mediumBPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
shell with sudo
echo 'BEGIN {system("/bin/sh 1<&0");exit()}' >/path/to/temp-file
bpftrace --unsafe /path/to/temp-fileTrips 1 Sigma rule: mediumBPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
2 of the 3 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for bpftrace. The identifier reads the line of each that runs bpftrace.
What detects it
Everyday use
List all available probes
sudo bpftrace -lIdentifyRun a one-liner program (e.g. syscall count by program)
sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'IdentifyRun a program from a file
sudo bpftrace path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.