Identifier / Programs / Linux and Unix
ip
Show/manipulate routing, devices, policy routing, and tunnels. Some subcommands such as address have their own usage documentation. tldr-pages
GTFOBins file-read, shell 3 Sigma rules name it 1 ATT&CK technique 3 documented commands
How ip is abused
file-read
-force-batchshell T1059.004 Command and Scripting Interpreter: Unix Shell
netns
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ip.
3 documented commands
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by error prints.
ip -force -batch /path/to/input-fileTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
shell with sudo, as SUID
ip netns add foo
ip netns exec foo /bin/sh
ip netns delete fooAs SUID:
ip netns add foo
ip netns exec foo /bin/sh -p
ip netns delete fooTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
shell with sudo
ip netns add foo
ip netns exec foo /bin/ln -s /proc/1/ns/net /var/run/netns/bar
ip netns exec bar /bin/sh
ip netns delete foo
ip netns delete barTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ip. The identifier reads the line of each that runs ip.
What detects it
Everyday use
List interfaces with detailed info
ip [aIdentifyTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
List interfaces with brief network layer info
ip -brief [aIdentifyTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
List interfaces with brief link layer info
ip -brief [lIdentifyTrips 1 Sigma rule: informationalSystem Network Discovery - Linux by Ömer Günal and remotephone, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.