Identifier / Programs / Linux and Unix
gnuplot
A graph plotter that outputs in several formats. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How gnuplot is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for gnuplot.
1 documented command
shell unprivileged, with sudo, as SUID
gnuplot -e 'system("/bin/sh 1>&0")'The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for gnuplot. The identifier reads the line that runs gnuplot.
What detects it
Everyday use
Start the interactive graph plotting shell
gnuplotIdentifyPlot the graph for the specified graph definition file
gnuplot path/to/definition.pltIdentifySet the output format by executing a command before loading the definition file
gnuplot -e "set output "path/to/file.png" size 1024,768" path/to/definition.pltIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.