Identifier / Programs / Linux and Unix
Operate on the user's mailbox. To send an email the message body is built from stdin. tldr-pages
GTFOBins shell 1 ATT&CK technique 2 documented commands
How mail is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
--execshell T1059.004 Command and Scripting Interpreter: Unix Shell
-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for mail.
2 documented commands
shell unprivileged, with sudo, as SUID
mail --exec='!/bin/sh'shell unprivileged, with sudo, as SUID
mail -f /etc/hosts
!/bin/shNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for mail. The identifier reads the line of each that runs mail.
What detects it
Everyday use
Open an interactive prompt to check personal mail
mailIdentifySend a typed email message with optional CC. The command-line below continues after pressing <Enter>. Input message text (can be multiline). Press <Ctrl d> to complete the message text
mail --subject "subject_line" to_user@example.com --cc "cc_email_address"IdentifySend an email that contains file content
mail <path/to/file.txt --subject "$HOSTNAME filename.txt" to_user@example.comIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.