Identifier / Programs / Linux and Unix
hashcat
Fast and advanced password recovery tool. tldr-pages
GTFOBins file-write 1 Sigma rule name it 1 documented command
How hashcat is abused
file-write
-m--quiet--potfile-disable-o--outfile-format--outfile-autohex-disableEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for hashcat.
1 documented command
file-write unprivileged, with sudo
Append data to the end of the output file, creating if does not exist.
echo -n DATA | tee /path/to/wordlist | md5sum | awk '{print $1}' >/path/to/hash
hashcat -m 0 --quiet --potfile-disable -o /path/to/output-file --outfile-format=2 --outfile-autohex-disable /path/to/hash /path/to/wordlistTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for hashcat. The identifier reads the line that runs hashcat.
What detects it
Everyday use
Perform a brute-force attack (mode 3) with the default hashcat mask
hashcat --hash-type hash_type_id --attack-mode 3 hash_valueIdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Perform a brute-force attack (mode 3) with a known pattern of 4 digits
hashcat --hash-type hash_type_id --attack-mode 3 hash_value "?d?d?d?d"IdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Perform a brute-force attack (mode 3) using at most 8 of all printable ASCII characters
hashcat --hash-type hash_type_id --attack-mode 3 --increment hash_value "?a?a?a?a?a?a?a?a"IdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.