Identifier / Programs / Linux and Unix
nsenter
Run a new command in a running process' namespace. Particularly useful for Docker images or chroot jails. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How nsenter is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nsenter.
1 documented command
shell unprivileged, with sudo, as SUID
The shell command can be omitted.
nsenter /bin/shAs SUID:
nsenter /bin/sh -pThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nsenter. The identifier reads the line that runs nsenter.
What detects it
Everyday use
Run a specific command using the same namespaces as an existing process
nsenter --target process_id --all command command_argumentsIdentifyRun a specific command in an existing process's mount|UTS|IPC|network|PID|user|cgroup|time namespace
nsenter --target process_id --mount command command_argumentsIdentifyRun a specific command in an existing process's UTS, time, and IPC namespaces
nsenter --target process_id --uts --time --ipc -- command command_argumentsIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of nsenter
-aEnter all supported namespaces (--all)-Fdon't fork, even if -p is used (--no-fork)-tPID to take namespaces from (--target)-CControl groups (--cgroup)-iSysV IPC: message queues, semaphores, shared memory (--ipc)-mMount/unmount tree (--mount)-nNetwork address, sockets, routing, iptables (--net)-pProcess IDs and init, will fork unless -F is used (--pid)-uHost and domain names (--uts)-UUIDs, GIDs, capabilities (--user)