Identifier / Programs / Linux and Unix
mv
Move or rename files and directories. tldr-pages
GTFOBins file-write, privilege-escalation 1 Sigma rule name it 2 documented commands
How mv is abused
file-write
privilege-escalation
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for mv.
2 documented commands
file-write unprivileged, with sudo, as SUID
echo DATA >/path/to/temp-file
mv /path/to/temp-file /path/to/output-fileprivilege-escalation with sudo, as SUID
This can be used to move and then read or write files from a restricted file systems or with elevated privileges.
mv /path/to/input-file /path/to/output-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for mv. The identifier reads the line of each that runs mv.
What detects it
Everyday use
Rename a file or directory when the target is not an existing directory
mv path/to/source path/to/targetIdentifyMove a file or directory into an existing directory
mv path/to/source path/to/existing_directoryIdentifyMove multiple files into an existing directory, keeping the filenames unchanged
mv path/to/source1 path/to/source2 ... path/to/existing_directoryIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of mv
-FDelete any existing DEST first (--remove-destination)-fForce copy by deleting destination file-iInteractive, prompt before overwriting existing DEST-nNo clobber (don't overwrite DEST)-t TARGETMove to TARGET dir (no DEST)-TDEST always treated as file, max 2 arguments-vVerbose-xAtomically exchange source/dest (--swap)