Identifier / Programs / Linux and Unix
fgrep
Find patterns in files using regexes. tldr-pages
GTFOBins file-read 1 Sigma rule name it 1 documented command
How fgrep is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fgrep.
1 documented command
file-read unprivileged, with sudo, as SUID
grep '' /path/to/input-fileThis command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fgrep. The identifier reads the line that runs fgrep.
What detects it
Everyday use
Search for a pattern within files
grep "search_pattern" path/to/file1 path/to/file2 ...IdentifySearch for an exact string (disables regexes)
grep --fixed-strings "exact_string" path/to/fileIdentifySearch for a pattern in all files recursively in a directory, ignoring binary files
grep [-rI|--recursive --binary-files=without-match] "search_pattern" path/to/directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of fgrep
-e REGEXRegex(es) to match.-f REGFILEFile(s) of regexes to match (1 per line).-rRecurse into subdirs-RRecurse following symlinks-M PATTERNMatch files (--include)-S PATTERNSkip files (--exclude)-IIgnore binary files--exclude-dir=PATTERNSkip directories-A NUMShow NUM lines after-B NUMShow NUM lines before match-C NUMNUM lines context (A+B)-Eextended regex syntax-Ffixed (literal match)-aalways text (not binary)-icase insensitive-m MAXmatch MAX many lines-vinvert match-wwhole word (implies -E)-xwhole line-zinput NUL terminated-Lfilenames with no match-Zoutput is NUL terminated-ccount of matching lines-lfilenames with a match-oonly matching part-qquiet (errors only)-ssilent (no error msg)-Hforce filename-bbyte offset of match-hhide filename-nline number of match