Identifier / Programs / Linux and Unix

emacs

The extensible, customizable, self-documenting, real-time display editor. tldr-pages

GTFOBins shell 3 Sigma rules name it 1 ATT&CK technique 3 documented commands

How emacs is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-Q

-nw

--eval

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for emacs.

3 documented commands

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo

emacs /path/to/input-file

Identify

file-write unprivileged, with sudo

emacs /path/to/output-file
DATA
C-x C-s

Identify

shell unprivileged, with sudo

emacs -Q -nw --eval '(term "/bin/sh")'

Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for emacs. The identifier reads the line of each that runs emacs.

What detects it

Sigma process creation rules

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Start Emacs and open a file

emacs path/to/fileIdentify

Open a file at a specified line number

emacs +line_number path/to/fileIdentify

Run an Emacs Lisp file as a script

emacs --script path/to/file.elIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

emacs

How emacs is abused

3 documented commands

What detects it

Everyday use

Other programs abused for shell