Identifier / Programs / Linux and Unix
msfconsole
Console for the Metasploit Framework. tldr-pages
GTFOBins inherit 1 Sigma rule name it 1 documented command
How msfconsole is abused
inherit
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for msfconsole.
1 documented command
inherit unprivileged, with sudo
msfconsole
irbTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
The command the identifier reads trips a Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for msfconsole. The identifier reads the line that runs msfconsole.
What detects it
Everyday use
Launch the interactive console (append --quiet to suppress the startup banner)
sudo msfconsoleIdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Execute console commands (Note: Use ; for passing multiple commands)
sudo msfconsole --execute-command "use auxiliary/scanner/portscan/tcp; set PORTS 80,443; set RHOSTS example.com; run; quit"IdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Run a specific resource file
sudo msfconsole --resource path/to/file.rcIdentifyTrips 1 Sigma rule: highLinux HackTool Execution by Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.