Identifier / Programs / Linux and Unix
ed
The original Unix text editor. tldr-pages
GTFOBins file-read, file-write, shell 3 Sigma rules name it 3 documented commands
How ed is abused
file-read
file-write
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ed.
3 documented commands
file-read unprivileged, with sudo, as SUID
ed /path/to/input-file
,p
qfile-write unprivileged, with sudo, as SUID
ed /path/to/output-file
a
DATA
.
w
qshell unprivileged, with sudo, as SUID
ed
!/bin/sh
qNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ed. The identifier reads the line of each that runs ed.
What detects it
Everyday use
Start an interactive editor session with an empty document
edIdentifyStart an interactive editor session with an empty document and a specific prompt
ed --prompt '> 'IdentifyStart an interactive editor session with user-friendly errors
ed --verboseIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.