Identifier / Programs / Linux and Unix
cut
Cut out fields from stdin or files. tldr-pages
GTFOBins file-read 1 documented command
How cut is abused
file-read
-dInput delimiter (default is TAB for -f, run of whitespace for -F) toybox-f1Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for cut.
1 documented command
file-read unprivileged, with sudo, as SUID
cut -d '' -f1 /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for cut. The identifier reads the line that runs cut.
Everyday use
Print the fifth character on each line
command | cut --characters 5IdentifyPrint the fifth to tenth character of each line of the specified file
cut --characters 5-10 path/to/fileIdentifySplit each line in a file by a delimiter into fields and print fields two and six (default delimiter is TAB)
cut --fields 2,6 path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of cut
-b LISTSelect bytes (with -n round start/end down to start of utf8 char)-c LISTSelect UTF-8 characters-C LISTSelect unicode columns-d DELIMInput delimiter (default is TAB for -f, run of whitespace for -F)-DDon't sort/collate selections or match -fF lines without delimiter-f LISTSelect fields (words) separated by single DELIM character-F LISTSelect fields separated by DELIM regex-O DELIMOutput separator (default one space for -F, input delim for -f)-sSkip lines without delimiters