Identifier / Programs / Linux and Unix
gem
A package manager for the Ruby programming language. tldr-pages
GTFOBins inherit, shell 1 ATT&CK technique 4 documented commands
How gem is abused
inherit
open
inherit
build
inherit
install
--fileEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gem.
4 documented commands
inherit unprivileged, with sudo
This requires the name of an installed gem to be provided, e.g., debug is usually installed.
gem open debuginherit unprivileged, with sudo
gem build /path/to/script.rbinherit unprivileged, with sudo
gem install --file /path/to/script.rbshell unprivileged, with sudo
This requires the name of an installed gem to be provided, e.g., debug is usually installed.
gem open -e '/bin/sh -s' debugNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gem. The identifier reads the line of each that runs gem.
What detects it
Everyday use
Search for remote gem(s) and show all available versions
gem search regex --allIdentifyInstall the latest version of a gem
gem install gem_nameIdentifyInstall a specific version of a gem
gem install gem_name --version 1.0.0IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.