Identifier / Programs / Linux and Unix
csvtool
Utility to filter and extract data from CSV formatted sources. tldr-pages
GTFOBins file-read, file-write, shell 1 ATT&CK technique 3 documented commands
How csvtool is abused
file-read
trim
file-write
trim
-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
call
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for csvtool.
3 documented commands
file-read unprivileged, with sudo, as SUID
The file is actually parsed and manipulated as CSV.
csvtool trim t /path/to/input-filefile-write unprivileged, with sudo, as SUID
The file is actually parsed and manipulated as CSV.
echo DATA >/path/to/temp-file
csvtool trim t /path/to/temp-file -o /path/to/output-fileshell unprivileged, with sudo, as SUID
csvtool call '/bin/sh;false' /etc/hostsNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for csvtool. The identifier reads the line of each that runs csvtool.
What detects it
Everyday use
Extract the second column from a CSV file
csvtool --column 2 path/to/file.csvIdentifyExtract the second and fourth columns from a CSV file
csvtool --column 2,4 path/to/file.csvIdentifyExtract lines from a CSV file where the second column exactly matches String
csvtool --column 2 --search '^String$' path/to/file.csvIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.