Identifier / Programs / Linux and Unix
cpulimit
A tool to throttle the CPU usage of other processes. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How cpulimit is abused
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cpulimit.
1 documented command
shell unprivileged, with sudo, as SUID
cpulimit -l 100 -f -- /bin/shAs SUID:
cpulimit -l 100 -f -- /bin/sh -pThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cpulimit. The identifier reads the line that runs cpulimit.
What detects it
Everyday use
Limit an existing process with PID 1234 to only use 25% of the CPU
cpulimit --pid 1234 --limit 25%IdentifyLimit an existing program by its executable name
cpulimit --exe program --limit 25IdentifyLaunch a given program and limit it to only use 50% of the CPU
cpulimit --limit 50 -- program argument1 argument2 ...IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.