Identifier / Programs / Linux and Unix

ionice

Get or set program I/O scheduling class and priority. Scheduling classes: 1 (realtime), 2 (best-effort), 3 (idle). Priority levels: 0 (the highest) - 7 (the lowest). tldr-pages

GTFOBins shell 1 ATT&CK technique 1 documented command

How ionice is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ionice.

1 documented command

from GTFOBins, each read by the identifier

shell unprivileged, with sudo, as SUID

ionice /bin/sh

Identify

As SUID:

ionice /bin/sh -p

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ionice. The identifier reads the line that runs ionice.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Run a command with the given scheduling class and priority

ionice --class scheduling_class --classdata priority commandIdentify

Set I/O scheduling class of a running process with a specific pid, Pgid, or uid

ionice --class scheduling_class -p idIdentify

-pAffect existing PID instead of spawning new child toybox

Set the priority of a running process, ignoring failure to do so (this can happen due to insufficient privileges or an old kernel version)

ionice --ignore --classdata priority --pid process_idIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

4 in toybox

Show every option of ionice

-c CLASSCLASS = 1-3: 1(realtime), 2(best-effort, default), 3(when-idle)

-n LEVELLEVEL = 0-7: (0 is highest priority, default = 5)

-pAffect existing PID instead of spawning new child

-tIgnore failure to set I/O priority