Identifier / Programs / Linux and Unix
nano
Text editor. An enhanced pico clone. tldr-pages
GTFOBins shell 4 Sigma rules name it 1 ATT&CK technique 4 documented commands
How nano is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-sEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nano.
4 documented commands
file-read unprivileged, with sudo, as SUID
The file content is displayed in the terminal interface.
nano /path/to/input-filefile-write unprivileged, with sudo, as SUID
nano /path/to/output-file
DATA
^Oshell unprivileged, with sudo, as SUID
nano
^R^X
reset; sh 1>&0 2>&0shell unprivileged, with sudo, as SUID
The SPELL environment variable can be used in place of the -s option if the command line cannot be changed.
nano -s /bin/sh
/bin/sh
^T^TAs SUID:
nano -s '/bin/sh -p'
/bin/sh -p
^T^TNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nano. The identifier reads the line of each that runs nano.
What detects it
Everyday use
Open specific files, moving to the next file after closing the previous one
nano path/to/file1 path/to/file2 ...IdentifyStart the editor without using configuration files
nano --ignorercfilesIdentifyOpen a file and position the cursor at a specific line and column
nano +line,column path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.