Identifier / Programs / Linux and Unix
dstat
Versatile tool for generating system resource statistics. tldr-pages
GTFOBins inherit 1 documented command
How dstat is abused
inherit
--xxxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for dstat.
1 documented command
inherit unprivileged, with sudo
dstat allows you to run arbitrary Python scripts loaded as "external plugins" if they are located in one of the directories, stated in the dstat man page under "FILES":
~/.dstat/(path of binary)/plugins//usr/share/dstat//usr/local/share/dstat/
Pick the one that you can write into. The plugin named xxx file name must be defined in the dstat_xxx.py file.
dstat --xxxThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for dstat. The identifier reads the line that runs dstat.
Everyday use
Display CPU, disk, net, paging, and system statistics
dstatIdentifyDisplay statistics every 5 seconds and 4 updates only
dstat 5 4IdentifyDisplay CPU and memory statistics only
dstat --cpu --memIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.