Identifier / Programs / Linux and Unix
logsave
Save the output of a command in a logfile. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How logsave is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-iEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for logsave.
1 documented command
shell unprivileged, with sudo, as SUID
logsave /dev/null /bin/sh -iAs SUID:
logsave /dev/null /bin/sh -i -pThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for logsave. The identifier reads the line that runs logsave.
What detects it
Everyday use
Execute command with specified argument(s) and save its output to log file
logsave path/to/logfile commandIdentifyTake input from stdin and save it in a log file
logsave logfile -IdentifyAppend the output to a log file, instead of replacing its current contents
logsave -a logfile commandIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.