Identifier / Programs / Linux and Unix
lastb
List last logged in users. tldr-pages
GTFOBins file-read 1 documented command
How lastb is abused
file-read
-a-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for lastb.
1 documented command
GTFOBins documents lastb with the commands of last.
file-read unprivileged, with sudo, as SUID
The output might be corrupted or incomplete if the file does not follow the expected database format.
last -a -f /path/to/input-fileTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowSystem Network Connections Discovery - Linux by Daniil Yugoslavskiy, oscd.community; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for lastb. The identifier reads the line that runs last.
Everyday use
List last logged in users
sudo lastbIdentifyList all last logged in users since a given time
sudo lastb --since YYYY-MM-DDIdentifyList all last logged in users until a given time
sudo lastb --until YYYY-MM-DDIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.