Identifier / Programs / Linux and Unix
last
View the last logged in users. tldr-pages
GTFOBins file-read 3 Sigma rules name it 1 documented command
How last is abused
file-read
-a-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for last.
1 documented command
file-read unprivileged, with sudo, as SUID
The output might be corrupted or incomplete if the file does not follow the expected database format.
last -a -f /path/to/input-fileTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for last. The identifier reads the line that runs last.
What detects it
Everyday use
View last login information (e.g., username, terminal, boot time, kernel) of all users as read from /var/log/wtmp
lastIdentifyTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
List login information of a specific user
last usernameIdentifyTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
Specify how many of the last logins to show
last --limit login_countIdentifyTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.