Identifier / Programs / Linux and Unix
nohup
Allow for a process to live when the terminal gets killed. tldr-pages
GTFOBins shell 3 Sigma rules name it 1 ATT&CK technique 2 documented commands
How nohup is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nohup.
2 documented commands
command unprivileged, with sudo, as SUID
The nohup.out file contains the standard output and error of the command.
nohup /path/to/command
cat nohup.outTrips 1 Sigma rule: mediumNohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
shell unprivileged, with sudo, as SUID
This creates a nohup.out file in the current working directory.
nohup /bin/sh -c '/bin/sh </dev/tty >/dev/tty 2>/dev/tty'As SUID:
nohup /bin/sh -p -c '/bin/sh -p </dev/tty >/dev/tty 2>/dev/tty'Trips 1 Sigma rule: mediumNohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nohup. The identifier reads the line of each that runs nohup.
What detects it
Everyday use
Run a process that can live beyond the terminal
nohup command argument1 argument2 ...IdentifyTrips 1 Sigma rule: mediumNohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Launch nohup in background mode
nohup command argument1 argument2 ... &IdentifyTrips 1 Sigma rule: mediumNohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Run a shell script that can live beyond the terminal
nohup path/to/script.sh &IdentifyTrips 1 Sigma rule: mediumNohup Execution by Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.