Identifier / Programs / Linux and Unix
ln
Create links to files and directories. tldr-pages
GTFOBins privilege-escalation 1 Sigma rule name it 1 documented command
How ln is abused
privilege-escalation
-fsEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ln.
1 documented command
privilege-escalation with sudo
This overrides ln itself with a symlink to a shell (or any other executable) that is to be executed as root, useful in case a sudo rule allows to only run ln by path. Warning, this is a destructive action.
ln -fs /bin/sh /bin/ln
lnThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ln. The identifier reads the line that runs ln.
What detects it
Everyday use
Create a symbolic link to a file or directory
ln --symbolic /path/to/file_or_directory path/to/symlinkIdentifyCreate a symbolic link relative to where the link is located
ln --symbolic path/to/file_or_directory path/to/symlinkIdentifyOverwrite an existing symbolic link to point to a different file
ln [-sf|--symbolic --force] /path/to/new_file path/to/symlinkIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of ln
-fForce the creation of the link, even if TO already exists-nSymlink at TO treated as file-rCreate relative symlink from -> to-sCreate a symbolic link-t DIRCreate links in DIR-TTO always treated as file, max 2 arguments-vVerbose