Identifier / Programs / Linux and Unix
fastfetch
Display information about your operating system, software, and hardware. tldr-pages
GTFOBins command, file-read, shell 1 ATT&CK technique 3 documented commands
How fastfetch is abused
command
-cfile-read
--fileshell T1059.004 Command and Scripting Interpreter: Unix Shell
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fastfetch.
3 documented commands
command unprivileged, with sudo, as SUID
echo '{"modules":[{"type":"command","key":"x","text":"exec /path/to/command"}]}' >/path/to/temp-file.jsonc
fastfetch -c /path/to/temp-file.jsoncfile-read unprivileged, with sudo, as SUID
The file content is used as the logo while some other information is displayed on its right.
fastfetch --file /path/to/input-fileshell unprivileged, with sudo, as SUID
echo '{"modules":[{"type":"command","key":"x","text":"exec /bin/sh 1>&0 2>&0"}]}' >/path/to/temp-file.jsonc
fastfetch -c /path/to/temp-file.jsoncNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fastfetch. The identifier reads the line of each that runs fastfetch.
What detects it
Everyday use
Display system information
fastfetchIdentifyDisplay full system information with all the modules enabled
fastfetch --config allIdentifyLoad a custom configuration file
fastfetch --config path/to/config_fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.