Identifier / Programs / Linux and Unix
loginctl
Manage the systemd login manager. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How loginctl is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
user-status
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for loginctl.
1 documented command
shell unprivileged, with sudo
loginctl user-status
!/bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for loginctl. The identifier reads the line that runs loginctl.
What detects it
Everyday use
Print all current sessions
loginctlIdentifyPrint all properties of a specific session
loginctl show-session session_id --allIdentifyPrint all properties of a specific user
loginctl show-user usernameIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.