Identifier / Programs / Linux and Unix

dash

Debian Almquist Shell, a modern, POSIX-compliant implementation of sh (not Bash-compatible). tldr-pages

GTFOBins file-write 10 Sigma rules name it 2 documented commands

How dash is abused

documented by GTFOBins

file-write

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dash.

2 documented commands

from GTFOBins, each read by the identifier

file-write unprivileged, with sudo, as SUID

dash -c 'echo DATA >/path/to/output-file'

Identify

shell unprivileged, with sudo, as SUID

dash

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dash. The identifier reads the line of each that runs dash.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

highSuspicious Invocation of Shell via RsyncFlorian Roth

highShell Execution Of Process Located In Tmp DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk

highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r)

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumShell Spawned by Celery Worker ProcessJennifer Batina

mediumExecution Of Script Located In Potentially Suspicious DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk

mediumSuspicious Installer Package Child ProcessSohan G (D4rkCiph3r)

mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r)

mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)

Everyday use

from tldr-pages, CC BY 4.0

Start an interactive shell session

dashIdentify

Execute specific commands

dash -c "echo 'dash is executed'"Identify

Execute a specific script

dash path/to/script.shIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

dash

How dash is abused

2 documented commands

What detects it

Everyday use

Other programs abused for file-write