Identifier / Programs / Linux and Unix

cat

Print and concatenate files. tldr-pages

GTFOBins file-read 11 Sigma rules name it 1 ATT&CK technique 1 documented command

How cat is abused

documented by GTFOBins

file-read

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cat.

1 documented command

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

cat /path/to/input-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cat. The identifier reads the line that runs cat.

What detects it

Sigma process creation rules

highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

lowDocker Container Discovery Via Dockerenv ListingSeth Hanford

lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community

informationalLocal Groups Discovery - MacOsÖmer Günal, Alejandro Ortuno, oscd.community

T1505.003Server Software Component: Web Shell

Everyday use

from tldr-pages, CC BY 4.0

Print the contents of a file to stdout

cat path/to/fileIdentify

Concatenate several files into an output file

cat path/to/file1 path/to/file2 ... >path/to/output_fileIdentify

Append several files to an output file

cat path/to/file1 path/to/file2 ... >>path/to/output_fileIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

4 in toybox

Show every option of cat

-eMark each newline with $

-tShow tabs as ^I

-uCopy one byte at a time (slow)

-vDisplay nonprinting characters as escape sequences with M-x for

cat

How cat is abused

1 documented command

What detects it

Everyday use

Options

Other programs abused for file-read