Identifier / Programs / Linux and Unix
certbot
The Let's Encrypt Agent for automatically obtaining and renewing TLS certificates. Successor to letsencrypt. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How certbot is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
certonly
-n-d--standalone--dry-run--agree-tos--email--logs-dir--work-dir--config-dir--pre-hookEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for certbot.
1 documented command
shell unprivileged, with sudo
This needs a writable directory, replace . if needed.
certbot certonly -n -d x --standalone --dry-run --agree-tos --email x --logs-dir . --work-dir . --config-dir . --pre-hook '/bin/sh 1>&0 2>&0'The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for certbot. The identifier reads the line that runs certbot.
What detects it
Everyday use
Obtain a new certificate via webroot authorization, but do not install it automatically
sudo certbot certonly --webroot --webroot-path path/to/webroot --domain subdomain.example.comIdentifyObtain a new certificate via nginx authorization, installing the new certificate automatically
sudo certbot --nginx --domain subdomain.example.comIdentifyObtain a new certificate via apache authorization, installing the new certificate automatically
sudo certbot --apache --domain subdomain.example.comIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.