Identifier / Programs / Linux and Unix

head

Output the first part of files. tldr-pages

GTFOBins file-read 7 Sigma rules name it 1 documented command

How head is abused

documented by GTFOBins

file-read

-c-0

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for head.

1 documented command

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

head -c-0 /path/to/input-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for head. The identifier reads the line that runs head.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

Everyday use

from tldr-pages, CC BY 4.0

Output the first few lines of a file

head -n count path/to/fileIdentify

-nNumber of lines to copy toybox

The example the identifier reads matches no GTFOBins abuse and trips no Sigma process-creation rule.

Options

4 in toybox

Show every option of head

-n NUMNumber of lines to copy

-c NUMNumber of bytes to copy

-qNever print headers

-vAlways print headers