Identifier / Programs / Linux and Unix
neofetch
Display information about the operating system, software, and hardware. tldr-pages
GTFOBins file-read, shell 1 ATT&CK technique 2 documented commands
How neofetch is abused
file-read
--asciishell T1059.004 Command and Scripting Interpreter: Unix Shell
--configEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for neofetch.
2 documented commands
file-read unprivileged, with sudo
The file content is used as the logo while some other information is displayed on its right.
neofetch --ascii /path/to/input-fileshell unprivileged, with sudo
echo 'exec /bin/sh' >/path/to/temp-file
neofetch --config /path/to/temp-fileNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for neofetch. The identifier reads the line of each that runs neofetch.
What detects it
Everyday use
Return the default config, and create it if it's the first time the program runs
neofetchIdentifyTrigger an info line from appearing in the output, where infoname is the function name in the configuration file, e.g. memory
neofetch --enable infonameIdentifyHide/Show OS architecture
neofetch --os_arch onIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.