Identifier / Programs / Linux and Unix
code
Cross platform and extensible code editor. tldr-pages
GTFOBins download, reverse-shell, upload 2 ATT&CK techniques 3 documented commands
How code is abused
upload
tunnel
--nameEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for code.
3 documented commands
download unprivileged, with sudo
This requires a valid GitHub account.
Run the command locally, then on the attacker box navigate to https://github.com/login/device, using the provided code to authorize the tunnel.
code tunnel --name xxxxxxreverse-shell unprivileged, with sudo
This requires a valid GitHub account.
Run the command locally, then on the attacker box navigate to https://github.com/login/device, using the provided code to authorize the tunnel.
code tunnel --name xxxxxxupload unprivileged, with sudo
This requires a valid GitHub account.
Run the command locally, then on the attacker box navigate to https://github.com/login/device, using the provided code to authorize the tunnel.
code tunnel --name xxxxxxNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for code. The identifier reads the line of each that runs code.
What detects it
Everyday use
Start Visual Studio Code
codeIdentifyOpen specific files/directories
code path/to/file_or_directory1 path/to/file_or_directory2 ...IdentifyCompare two specific files
code --diff path/to/file1 path/to/file2IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.