Identifier / Programs / Linux and Unix
cp
Copy files and directories. tldr-pages
GTFOBins privilege-escalation 2 Sigma rules name it 4 documented commands
How cp is abused
privilege-escalation
--attributes-only--preserveEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cp.
4 documented commands
file-read unprivileged, with sudo, as SUID
cp /path/to/input-file /dev/stdoutfile-write unprivileged, with sudo, as SUID
echo DATA | cp /dev/stdin /path/to/output-fileprivilege-escalation with sudo, as SUID
This can be used to copy and then read or write files from a restricted file systems or with elevated privileges. (The GNU version of cp has the --parents option that can be used to also create the directory hierarchy specified in the source path, to the destination folder.)
cp /path/to/input-file /path/to/output-fileprivilege-escalation with sudo, as SUID
This can copy SUID permissions from any SUID binary (e.g., /path/to/input-file) to another.
cp --attributes-only --preserve=all /path/to/input-file /path/to/output-fileNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cp. The identifier reads the line of each that runs cp.
What detects it
Everyday use
Copy a file to another location
cp path/to/source_file path/to/target_fileIdentifyCopy a file into another directory, keeping the filename
cp path/to/source_file path/to/target_parent_directoryIdentifyRecursively copy a directory's contents to another location (if the destination exists, the directory is copied inside it)
cp --recursive path/to/source_directory path/to/target_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of cp
-aSame as -dpr-DCreate leading dirs under DEST (--parents)-dDon't dereference symlinks-FDelete any existing DEST first (--remove-destination)-fDelete destination files we can't write to-HFollow symlinks listed on command line-iInteractive, prompt before overwriting existing DEST-LFollow all symlinks-lHard link instead of copy-nNo clobber (don't overwrite DEST)-PDo not follow symlinks-pPreserve timestamps, ownership, and mode-RRecurse into subdirectories (DEST must be a directory)-rSynonym for -R-sSymlink instead of copy-TDEST always treated as file, max 2 arguments-t TARGETCopy to TARGET dir (no DEST)-uUpdate (keep newest mtime)-vVerbose