Identifier / Programs / Linux and Unix
expect
Script executor that interacts with other programs that require user input. tldr-pages
GTFOBins shell 1 ATT&CK technique 2 documented commands
How expect is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for expect.
2 documented commands
file-read unprivileged, with sudo, as SUID
The file is read and parsed as an expect command file, the content of the first invalid line is returned in an error message.
expect /path/to/input-fileshell unprivileged, with sudo, as SUID
expect -c 'spawn /bin/sh;interact'As SUID:
expect -c 'spawn /bin/sh -p;interact'None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for expect. The identifier reads the line of each that runs expect.
What detects it
Everyday use
Execute an expect script from a file
expect path/to/fileIdentifyExecute a specified expect script
expect -c "commands"IdentifyEnter an interactive REPL (use exit or <Ctrl d> to exit)
expect -iIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.