more explained: GTFOBins abuse, Sigma rules and examples

Identifier / Programs / Linux and Unix

Interactively display a file, allowing scrolling and searching. tldr-pages

GTFOBins file-read, shell 7 Sigma rules name it 2 documented commands

How more is abused

documented by GTFOBins

file-read

shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for more.

2 documented commands

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

The file is displayed in the terminal interface.

more /path/to/input-file

Identify

shell unprivileged, with sudo, as SUID

more /etc/hosts
!/bin/sh

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for more. The identifier reads the line of each that runs more.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

Everyday use

from tldr-pages, CC BY 4.0

Open a file

more path/to/fileIdentify

Display a specific line

more +line_number path/to/fileIdentify

Go to the next page

<Space>

None of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

more

How more is abused

2 documented commands

What detects it

Everyday use

Other programs abused for file-read