Identifier / Programs / Linux and Unix
dpkg
Debian package manager. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. Some subcommands such as deb have their own usage documentation. tldr-pages
GTFOBins inherit, shell 2 Sigma rules name it 1 ATT&CK technique 2 documented commands
How dpkg is abused
inherit
-lshell T1059.004 Command and Scripting Interpreter: Unix Shell
-iEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dpkg.
2 documented commands
inherit unprivileged, with sudo, as SUID
dpkg -lshell with sudo
Generate the Debian package with fpm and upload it to the target.
echo 'exec /bin/sh' >x.sh
fpm -n x -s dir -t deb -a all --before-install x.sh .dpkg -i x_1.0_all.debNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dpkg. The identifier reads the line of each that runs dpkg.
What detects it
Everyday use
Install a package
sudo dpkg --install path/to/file.debIdentifyRemove a package
sudo dpkg --remove packageIdentifyTrips 1 Sigma rule: lowLinux Package Uninstall by Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
List installed packages
dpkg --list patternIdentifyOf the 3 examples the identifier reads, 1 matches GTFOBins abuse or trips a Sigma process-creation rule.