Identifier / Programs / Linux and Unix

java

Java application launcher. tldr-pages

GTFOBins shell 1 Sigma rule name it 1 documented command

How java is abused

documented by GTFOBins

shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for java.

1 documented command

from GTFOBins, each read by the identifier

shell unprivileged, with sudo

The Shell.class class file can be compiled offline, then uploaded to the target:

cat >Shell.java <<EOF
public class Shell {
    public static void main(String[] args) throws Exception {
        new ProcessBuilder("/bin/sh").inheritIO().start().waitFor();
    }
}
EOF

javac Shell.java

java Shell

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for java. The identifier reads the line that runs java.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

Everyday use

from tldr-pages, CC BY 4.0

Execute a Java .class file that contains a main method by using just the class name

java classnameIdentify

Execute a Java program and use additional third-party or user-defined classes

java -classpath path/to/classes1:path/to/classes2:. classnameIdentify

Execute a .jar program

java -jar filename.jarIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

java

How java is abused

1 documented command

What detects it

Everyday use

Other programs abused for shell