Identifier / Programs / Linux and Unix

grep

Find patterns in files using regexes. tldr-pages

GTFOBins file-read 8 Sigma rules name it 1 ATT&CK technique 1 documented command

How grep is abused

documented by GTFOBins

file-read

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for grep.

1 documented command

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

grep '' /path/to/input-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for grep. The identifier reads the line that runs grep.

What detects it

Sigma process creation rules

highPotential GobRAT File Discovery Via GrepJoseliyo Sanchez, @Joseliyo_Jstnk

lowOS Architecture Discovery Via GrepJoseliyo Sanchez, @Joseliyo_Jstnk

highCredentials In FilesIgor Fits, Mikhail Larin, oscd.community

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

mediumSecurity Software Discovery - MacOsDaniil Yugoslavskiy, oscd.community

lowSecurity Software Discovery - LinuxDaniil Yugoslavskiy, oscd.community

lowLocal System Accounts Discovery - MacOsAlejandro Ortuno, oscd.community

T1082System Information Discovery

Everyday use

from tldr-pages, CC BY 4.0

Search for a pattern within files

grep "search_pattern" path/to/file1 path/to/file2 ...Identify

Search for an exact string (disables regexes)

grep --fixed-strings "exact_string" path/to/fileIdentify

Search for a pattern in all files recursively in a directory, ignoring binary files

grep [-rI|--recursive --binary-files=without-match] "search_pattern" path/to/directoryIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

31 in toybox

Show every option of grep

-e REGEXRegex(es) to match.

-f REGFILEFile(s) of regexes to match (1 per line).

-rRecurse into subdirs

-RRecurse following symlinks

-M PATTERNMatch files (--include)

-S PATTERNSkip files (--exclude)

-IIgnore binary files

--exclude-dir=PATTERNSkip directories

-A NUMShow NUM lines after

-B NUMShow NUM lines before match

-C NUMNUM lines context (A+B)

-Eextended regex syntax

-Ffixed (literal match)

-aalways text (not binary)

-icase insensitive

-m MAXmatch MAX many lines

-vinvert match

-wwhole word (implies -E)

-xwhole line

-zinput NUL terminated

-Lfilenames with no match

-Zoutput is NUL terminated

-ccount of matching lines

-lfilenames with a match

-oonly matching part

-qquiet (errors only)

-ssilent (no error msg)

-Hforce filename

-bbyte offset of match

-hhide filename

-nline number of match