Identifier / Programs / Linux and Unix
make
Task runner for targets described in Makefile. Mostly used to control the compilation of an executable from source code. tldr-pages
GTFOBins file-read, file-write, shell 1 ATT&CK technique 3 documented commands
How make is abused
file-read
-s--evalfile-write
-s--evalshell T1059.004 Command and Scripting Interpreter: Unix Shell
--evalEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for make.
3 documented commands
file-read unprivileged, with sudo, as SUID
make -s --eval='$(file >/dev/stdout,$(file </path/to/input-file))' .file-write unprivileged, with sudo, as SUID
make -s --eval='$(file >/path/to/output-file,DATA)' .shell unprivileged, with sudo, as SUID
make --eval='$(shell /bin/sh 1>&0)' .None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for make. The identifier reads the line of each that runs make.
What detects it
Everyday use
Call the first target specified in the Makefile (usually named "all")
makeIdentifyCall a specific target
make installIdentifyCall a specific target, executing 4 jobs at a time in parallel
make --jobs 4 targetIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.