Ceplin Command Identifier

Identifier / Programs / Linux and Unix

fish

The Friendly Interactive SHell, a command-line interpreter designed to be user friendly. tldr-pages

GTFOBins shell 5 Sigma rules name it 1 documented command

Opens the identifier with your command. It is read in your browser and sent nowhere.

How fish is abused

documented by GTFOBins

shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for fish.

1 documented command

from GTFOBins, each read by the identifier

shell unprivileged, with sudo, as SUID

fish
Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for fish. The identifier reads the line that runs fish.

What detects it

Sigma process creation rules
highShell Execution Of Process Located In Tmp DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk
highSuspicious Microsoft Office Child Process - MacOSSohan G (D4rkCiph3r)
mediumShell Spawned by Celery Worker ProcessJennifer Batina
mediumExecution Of Script Located In Potentially Suspicious DirectoryJoseliyo Sanchez, @Joseliyo_Jstnk
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)

Everyday use

from tldr-pages, CC BY 4.0

Start an interactive shell session

Start an interactive shell session without loading startup configs

fish --no-configIdentify

Execute specific commands

fish --command "echo 'fish is executed'"Identify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Other programs abused for shell

aa-exec · agetty · ansible-playbook · ansible-test · aoss · apt · apt-get · arch-nspawn · asterisk · at · autoconf · autoheader · autoreconf · awk · borg · bpftrace