Identifier / Programs / Linux and Unix
firejail
Securely sandboxes processes to containers using built-in Linux capabilities. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How firejail is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for firejail.
1 documented command
shell unprivileged, with sudo
firejail /bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for firejail. The identifier reads the line that runs firejail.
What detects it
Everyday use
Integrate firejail with your desktop environment
sudo firecfgIdentifyOpen a restricted Mozilla Firefox
firejail firefoxIdentifyStart a restricted Apache server on a known interface and address
firejail --net=eth0 --ip=192.168.1.244 /etc/init.d/apache2 startIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.