Identifier / Programs / Linux and Unix
nmap
Network exploration tool and security/port scanner. Some features (e.g. SYN scan) activate only when nmap is run with root privileges. tldr-pages
GTFOBins file-read, file-write, inherit, shell 3 Sigma rules name it 1 ATT&CK technique 4 documented commands
How nmap is abused
file-read
-iLfile-write
-oGinherit
--scriptshell T1059.004 Command and Scripting Interpreter: Unix Shell
--interactiveEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nmap.
4 documented commands
file-read unprivileged, with sudo, as SUID
The file is actually parsed as a list of hosts/networks, lines are leaked through error messages.
nmap -iL /path/to/input-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
file-write unprivileged, with sudo, as SUID
The payload appears inside the regular nmap output.
nmap -oG=/path/to/output-file DATATrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
echo '...' >/path/to/temp-file
nmap --script=/path/to/temp-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
shell unprivileged, with sudo, as SUID
nmap --interactive
!/bin/shTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
All 4 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nmap. The identifier reads the line of each that runs nmap.
What detects it
Everyday use
Scan the top 1000 ports of a remote host with various verbosity levels
nmap -v1 ip_or_hostnameIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Run a ping sweep over an entire subnet or individual hosts very aggressively
nmap -T5 -sn 192.168.0.0/24IdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Enable OS detection, version detection, script scanning, and traceroute of hosts from a file
sudo nmap -A -iL path/to/file.txtIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.