Identifier / Programs / Linux and Unix
pic
Picture preprocessor for the groff (GNU Troff) document formatting system. tldr-pages
GTFOBins shell 1 ATT&CK technique 2 documented commands
How pic is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-UEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pic.
2 documented commands
file-read unprivileged, with sudo, as SUID
The output is prefixed with some content.
pic /path/to/input-fileshell unprivileged, with sudo, as SUID
pic -U
.PS
sh X sh XNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pic. The identifier reads the line of each that runs pic.
What detects it
Everyday use
Process input with pictures, saving the output for future typesetting with groff to PostScript
pic path/to/input.pic >path/to/output.roffIdentifyTypeset input with pictures to PDF using the me macro package
pic -T pdf path/to/input.pic | groff -me -T pdf >path/to/output.pdfIdentifyNone of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.