Identifier / Programs / Linux and Unix
egrep
Find patterns in files using extended regexes. tldr-pages
GTFOBins file-read 2 Sigma rules name it 1 documented command
How egrep is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for egrep.
1 documented command
file-read unprivileged, with sudo, as SUID
grep '' /path/to/input-fileThis command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for egrep. The identifier reads the line that runs egrep.
What detects it
Everyday use
Search for one or more repeated characters
egrep 'a+' path/to/fileIdentifySearch for zero or one occurrences of a character (optional match)
egrep 'a?' path/to/fileIdentifySearch for 10 repetitions of a character
egrep 'a{10}' path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of egrep
-e REGEXRegex(es) to match.-f REGFILEFile(s) of regexes to match (1 per line).-rRecurse into subdirs-RRecurse following symlinks-M PATTERNMatch files (--include)-S PATTERNSkip files (--exclude)-IIgnore binary files--exclude-dir=PATTERNSkip directories-A NUMShow NUM lines after-B NUMShow NUM lines before match-C NUMNUM lines context (A+B)-Eextended regex syntax-Ffixed (literal match)-aalways text (not binary)-icase insensitive-m MAXmatch MAX many lines-vinvert match-wwhole word (implies -E)-xwhole line-zinput NUL terminated-Lfilenames with no match-Zoutput is NUL terminated-ccount of matching lines-lfilenames with a match-oonly matching part-qquiet (errors only)-ssilent (no error msg)-Hforce filename-bbyte offset of match-hhide filename-nline number of match