Identifier / Programs / Linux and Unix
dmidecode
Display the DMI (alternatively known as SMBIOS) table contents in a human-readable format. tldr-pages
GTFOBins file-write 1 Sigma rule name it 1 documented command
How dmidecode is abused
file-write
--no-sysfs-d--dump-binEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dmidecode.
1 documented command
file-write unprivileged
It can be used to write files using a specially crafted SMBIOS file that can be read as a memory device by dmidecode. Generate the file with dmiwrite and upload it to the target.
--dump-bin, will cause dmidecode to write the payload to the destination specified, prepended with 32 null bytes.
--no-sysfs, if the target system is using an older version of dmidecode, you may need to omit the option.
make dmiwrite
echo DATA >/path/to/temp-file
./dmiwrite /path/to/temp-file x.dmidmidecode --no-sysfs -d x.dmi --dump-bin /path/to/output-fileTrips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dmidecode. The identifier reads the line that runs dmidecode.
What detects it
Everyday use
Show all DMI table contents
sudo dmidecodeIdentifyTrips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community
Show the BIOS version
sudo dmidecode --string bios-versionIdentifyTrips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community
Show the system's serial number
sudo dmidecode --string system-serial-numberIdentifyTrips 1 Sigma rule: informationalSystem Information Discovery by Ömer Günal, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.