Identifier / Programs / Linux and Unix
file
Determine file type. tldr-pages
GTFOBins file-read 2 Sigma rules name it 1 ATT&CK technique 2 documented commands
How file is abused
file-read
-ffile-read
-mEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for file.
2 documented commands
file-read unprivileged, with sudo, as SUID
Each input line is treated as a filename for the file command and the output is corrupted by a suffix : followed by the result or the error of the operation.
file -f /path/to/input-filefile-read unprivileged, with sudo, as SUID
Each line is corrupted by a prefix string and wrapped inside quotes.
If a line in the target file begins with a #, it will not be printed as these lines are parsed as comments.
It can also be provided with a directory and will read each file in the directory.
file -m /path/to/input-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for file. The identifier reads the line of each that runs file.
What detects it
Everyday use
Give a description of the type of the specified file
file path/to/fileIdentifyDo not print the filepath
file --brief path/to/fileIdentifyLook inside a zipped file and determine the file type(s) inside
file --uncompress path/to/file.zipIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of file
-bBrief (no filename)-hDon't follow symlinks (default)-LFollow symlinks-sShow block/char device contents