Identifier / Programs / Linux and Unix
find
Find files or directories under a directory tree, recursively. tldr-pages
GTFOBins file-read, file-write, shell 6 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How find is abused
file-read
-execRun command with path toyboxfile-write
-fprintf-quitExit immediately toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-execRun command with path toybox-quitExit immediately toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for find.
3 documented commands
file-read unprivileged, with sudo, as SUID
This uses cat to actually read the file, but since permissions are not dropped, it's executed with the same privileges as find.
find /path/to/input-file -exec cat {} \;Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
file-write unprivileged, with sudo, as SUID
DATA is a format string, it supports some escape sequences.
find / -fprintf /path/to/output-file DATA -quitTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
shell unprivileged, with sudo, as SUID
find . -exec /bin/sh \; -quitAs SUID:
find . -exec /bin/sh -p \; -quitTrips 2 Sigma rules: highShell Execution via Find - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.); informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for find. The identifier reads the line of each that runs find.
What detects it
Everyday use
Find files by extension
find path/to/directory -name '*.ext'Identify-namefilename with wildcards toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Find files matching multiple path/name patterns
find path/to/directory -path '*/path/*/*.ext' -or -name '*pattern*'Identify-pathpath name with wildcards toybox-namefilename with wildcards toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Find directories matching a given name, in case-insensitive mode
find path/to/directory -type d -iname '*lib*'Identify-typetype is (block, char, dir, file, symlink, pipe, socket) toybox-inameignore case -name toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.
Options
Show every option of find
-HFollow command line symlinks-LFollow all symlinks-name PATTERNfilename with wildcards-inameignore case -name-path PATTERNpath name with wildcards-ipathignore case -path-user UNAMEbelongs to user UNAME-nouseruser ID not known-group GROUPbelongs to group GROUP-nogroupgroup ID not known-perm [-/]MODEpermissions (-=min /=any)-pruneignore dir contents-size N[c]512 byte blocks (c=bytes)-xdevonly this filesystem-links Nhardlink count-emptyempty files and dirs-atime N[u]accessed N units ago-truealways true-ctime N[u]created N units ago-falsealways false-mtime N[u]modified N units ago-executableaccess(X_OK) perm+ACL-inum Ninode number N-readableaccess(R_OK) perm+ACL-context PATTERNsecurity context-depthcontents before dir-samefile FILEhardlink to FILE-maxdepth Nat most N dirs down-newer FILEnewer mtime than FILE-mindepth Nat least N dirs down-newerXY FILEX=acm time > FILE's Y=acm time (Y=t: FILE is literal time)-type [bcdflps]type is (block, char, dir, file, symlink, pipe, socket)-[acm]timeare d (days, default), h (hours), m (minutes), or s (seconds).-printPrint match with newline-print0Print match with null-execRun command with path-execdirRun command in file's dir-okAsk before exec-okdirAsk before execdir-deleteRemove matching file/dir-printf FORMATPrint using format string-quitExit immediately-printf FORMATcharacters are \ escapes and: