Identifier / Programs
Commonly abused programs
Every program LOLBAS and GTFOBins list, with what it is, how it is abused, the Sigma rules that name it and its options, from the same references the identifier reads. To see what one command line does, paste it into the identifier.
Windows
acccheckconsole.exeExecute, AWL Bypassaddinutil.exeExecuteadplus.exeDump, Executeadvpack.dllAWL Bypass, Executeagentexecutor.exeExecuteappcert.exeExecuteappinstaller.exeDownloadapplaunch.exeAWL Bypassapplauncher.exeExecuteappvlp.exeExecuteaspnet_compiler.exeAWL Bypassat.exeExecuteatbroker.exeExecutebash.exeExecute, AWL Bypassbcp.exeDownloadbginfo.exeExecute, AWL Bypassbitsadmin.exeADS, Download, Copy, Executecdb.exeExecutecertoc.exeExecute, Downloadcertreq.exeDownload, Uploadcertutil.exeDownload, ADS, Encode, Decodechange.exeExecutecipher.exeTampercl_invocation.ps1Executecl_loadassembly.ps1Executecl_mutexverifiers.ps1Executecmd.exeADS, Download, Uploadcmdkey.exeCredentialscmdl32.exeDownloadcmstp.exeExecute, AWL Bypasscolorcpl.exeCopycomputerdefaults.exeUAC Bypasscomsvcs.dllDumpconfigsecuritypolicy.exeUpload, Downloadconhost.exeExecutecontrol.exeADS, Executecoregen.exeExecute, AWL Bypasscreatedump.exeDumpcsc.exeCompilecscript.exeADS, AWL Bypasscsi.exeExecutecustomshellhost.exeExecutedatasvcutil.exeUploaddbgsrv.exeExecutedefaultpack.exeExecutedesk.cplExecutedesktopimgdownldr.exeDownloaddevicecredentialdeployment.exeConcealdevinit.exeExecutedevtoolslauncher.exeExecutedevtunnel.exeDownloaddfshim.dllAWL Bypassdfsvc.exeAWL Bypassdiantz.exeADS, Download, Executediskshadow.exeDump, Executednscmd.exeExecutednx.exeExecutedotnet-counters.exeExecutedotnet-trace.exeExecutedotnet.exeAWL Bypass, Executedsdbutil.exeDumpdtutil.exeCopydump64.exeDumpdumpminitool.exeDumpdxcap.exeExecuteecmangen.exeDownloadesentutl.exeCopy, ADS, Downloadeudcedit.exeUAC Bypasseventvwr.exeUAC Bypassexcel.exeDownloadexpand.exeDownload, Copy, ADSexplorer.exeExecuteextexport.exeExecuteextrac32.exeADS, Download, Copyfindstr.exeADS, Credentials, Downloadfinger.exeDownloadfltmc.exeTamperforfiles.exeExecute, ADSfsi.exeAWL Bypassfsianycpu.exeAWL Bypassfsutil.exeTamper, Executeftp.exeExecute, Downloadgpscript.exeExecutehh.exeDownload, Executeie4uinit.exeExecuteieadvpack.dllAWL Bypass, Executeiediagcmd.exeExecuteieexec.exeDownload, Executeieframe.dllExecuteilasm.exeCompileimewdbld.exeDownloadinfdefaultinstall.exeExecuteinstallutil.exeAWL Bypass, Execute, Downloadintellitrace.exeExecuteiscsicpl.exeUAC Bypassjsc.exeCompilelaunch-vsdevshell.ps1Executeldifde.exeDownloadlogger.exeExecutemakecab.exeADS, Download, Executemanage-bde.wsfExecutemavinject.exeExecute, ADSmftrace.exeExecutemicrosoft.nodejstools.pressanykey.exeExecutemicrosoft.workflow.compiler.exeExecute, AWL Bypassmmc.exeExecute, Downloadmofcomp.exeExecutempcmdrun.exeDownload, ADSmpiexec.exeExecutemsaccess.exeDownloadmsbuild.exeAWL Bypass, Executemsconfig.exeExecutemscopilot.exeExecutemscopilot_proxy.exeExecutemsdeploy.exeExecute, AWL Bypass, Copymsdt.exeExecute, AWL Bypassmsedge.exeDownload, Executemsedge_proxy.exeDownload, Executemsedgewebview2.exeExecutemshta.exeExecute, ADS, Downloadmshtml.dllExecutemsiexec.exeExecutemsohtmed.exeDownloadmsoxmled.exeDownloadmspub.exeDownloadmsxsl.exeExecute, AWL Bypass, Download, ADSnetsh.exeExecutengen.exeDownloadnmcap.exeReconnaissancentdsutil.exeDumpntsd.exeExecuteodbcad32.exeUAC Bypassodbcconf.exeExecuteofflinescannershell.exeExecuteonedrivestandaloneupdater.exeDownloadopenconsole.exeExecuteoutlook.exeDownloadpcalua.exeExecutepcwrun.exeExecutepcwutl.dllExecutepester.batExecutephotoviewer.dllDownloadpixtool.exeExecutepktmon.exeReconnaissancepnputil.exeExecutepowerpnt.exeDownloadpresentationhost.exeExecute, Downloadprint.exeADS, Copyprintbrm.exeDownload, ADSprocdump.exeExecuteprotocolhandler.exeDownloadprovlaunch.exeExecutepsr.exeReconnaissancepubprn.vbsExecutequery.exeExecuterasautou.exeExecutercsi.exeExecute, AWL Bypassrdrleakdiag.exeDumpreg.exeADS, Credentialsregasm.exeAWL Bypass, Executeregedit.exeADSregini.exeADSregister-cimprovider.exeExecuteregsvcs.exeExecute, AWL Bypassregsvr32.exeAWL Bypass, Executeremote.exeAWL Bypass, Executereplace.exeCopy, Downloadreset.exeExecuterpcping.exeCredentialsrundll32.exeAWL Bypass, Execute, ADS, Download, Dumprunexehelper.exeExecuterunonce.exeExecuterunscripthelper.exeExecutesc.exeADSschtasks.exeExecutescp.exeExecutescriptrunner.exeExecutescrobj.dllDownloadsetres.exeExecutesettingsynchost.exeExecutesetupapi.dllAWL Bypass, Executesetupugc.exeExecutesftp.exeExecuteshdocvw.dllExecuteshell32.dllExecuteshimgvw.dllDownloadsigverif.exeExecutesqldumper.exeDumpsqlps.exeExecutesqltoolsps.exeExecutesquirrel.exeDownload, AWL Bypass, Executessh.exeExecutestordiag.exeExecutesyncappvpublishingserver.exeExecutesyncappvpublishingserver.vbsExecutesyssetup.dllAWL Bypass, Executetar.exeADS, Copyte.exeExecuteteams.exeExecutetestwindowremoteagent.exeUploadtracker.exeExecute, AWL Bypassttdinject.exeExecutetttracer.exeExecute, Dumpunregmp2.exeExecuteupdate.exeDownload, AWL Bypass, Executeurl.dllExecuteutilityfunctions.ps1Executevbc.exeCompileverclsid.exeExecutevisio.exeDownloadvisualuiaverifynative.exeAWL Bypassvsdiagnostics.exeExecutevshadow.exeExecutevsiisexelauncher.exeExecutevsjitdebugger.exeExecutevslaunchbrowser.exeDownload, Executevsls-agent.exeExecutevssadmin.exeTampervstest.console.exeAWL Bypasswab.exeExecutewbadmin.exeDumpwbemtest.exeExecutewfc.exeAWL Bypasswfmformat.exeExecutewindbg.exeExecutewinfile.exeExecutewinget.exeExecute, Download, AWL Bypasswinproj.exeDownloadwinrm.vbsExecute, AWL Bypasswinword.exeDownloadwlrmdr.exeExecutewmic.exeADS, Execute, Copyworkfolders.exeExecutewrite.exeExecutewsb.exeExecutewscript.exeADSwsl.exeExecute, Downloadwsreset.exeUAC Bypasswt.exeExecutewuauclt.exeExecutexbootmgr.exeExecutexbootmgrsleep.exeExecutexsd.exeDownloadxwizard.exeExecute, Downloadzipfldr.dllExecuteLinux and Unix
7zfile-readaa-execshellabdownload, uploadacrcommandagettyshellalpinefile-readansible-playbookshellansible-testshellaossshellapache2file-readapache2ctlfile-readapport-cliinheritaptinherit, shellapt-getinherit, shellaptitudeinheritarfile-readarch-nspawnshellaria2ccommand, download, file-readarjfile-writearpfile-readasfile-readascii-xfrfile-readascii85file-readashfile-writeaspellfile-readasteriskshellatcommand, shellatobmfile-readautoconfshellautoheadershellautoreconfshellawkshellawsfile-read, inheritbase32file-readbase58file-readbase64file-readbasencfile-readbasezfile-readbashdownload, file-read, file-write, library-load, reverse-shell, uploadbashbuginheritbatcatinheritbbotfile-readbcfile-readbconsolefile-readbeeinheritborgshellbpftraceshellbridgefile-readbundleinherit, shellbundlerinherit, shellbusctlinherit, shellbusyboxinherit, reverse-shell, uploadbyebuginheritbzip2file-readc89file-read, file-write, shellc99file-read, file-write, shellcabalshellcanceluploadcapshshellcargoinheritcatfile-readccfile-read, file-write, shellcdistshellcertbotshellchattrprivilege-escalationcheck_by_sshshellcheck_cupsfile-readcheck_logfile-read, file-writecheck_memoryfile-readcheck_raidfile-readcheck_ssl_certshellcheck_statusfilefile-readchmodprivilege-escalationchoomshellchownprivilege-escalationchrootshellchrtshellclamscanfile-readclispshellcmakefile-readcmpfile-readcobcshellcodedownload, reverse-shell, uploadcodexshellcolumnfile-readcommfile-readcomposershellcowsayinheritcowthinkinheritcpprivilege-escalationcpaninheritcpiofile-read, file-write, shellcpulimitshellcrashcommand, inheritcrontabcommand, inheritcshfile-writecsplitfile-writecsvtoolfile-read, file-write, shellctrshellcupsfilterfile-readcurldownload, file-write, library-load, uploadcutfile-readdashfile-writedatefile-readdcshellddfile-read, file-writedebugfsshelldhclientshelldialogfile-readdifffile-readdigfile-readdistccshelldmesgfile-read, inheritdmidecodefile-writedmsetupshelldnfcommanddnsmasqcommanddoasshelldockershelldos2unixfile-read, file-writedosboxfile-read, file-writedotnetfile-read, shelldpkginherit, shelldstatinheritdvipsshelleasy_installinheriteasyrsashellebinheritedfile-read, file-write, shellefaxfile-readegrepfile-readelvishfile-read, file-writeemacsshellenscriptshellenvshelleqnfile-readespeakfile-readexshellexiftoolfile-read, file-write, inheritexpandfile-readexpectshellfacterinheritfail2ban-clientcommandfastfetchcommand, file-read, shellffmpeglibrary-loadfgrepfile-readfilefile-readfindfile-read, file-write, shellfingerdownload, uploadfirejailshellfishshellflockshellfmtfile-readfoldfile-readforgeshellfpingfile-readftpdownload, uploadfzfcommand, shellg++file-read, file-write, shellgawkshellgccfile-read, file-write, shellgcloudinheritgcorefile-readgdbfile-write, shellgeminherit, shellgenieshellgenisoimagefile-readgetentprivilege-escalationghcshellghcishellgimpinheritginshshellgitfile-read, file-write, inherit, shellgnuplotshellgobind-shell, file-read, file-write, reverse-shell, shellgrcshellgrepfile-readgtesterfile-write, shellguileshellgzipfile-readhashcatfile-writehdfile-readheadfile-readhexdumpfile-readhgshellhighlightfile-readhping3uploadiconvfile-read, file-writeiftopshellinstallprivilege-escalationioniceshellipfile-read, shelliptables-savefile-writeirbinheritispellshelljavashelljjsdownload, file-read, file-write, reverse-shell, shelljoeshelljoinfile-readjournalctlinheritjqfile-readjrunscriptdownload, file-read, file-write, reverse-shell, shelljshellfile-read, file-write, shelljtagshelljuliadownload, file-read, file-write, reverse-shell, shellknifeinheritkshdownload, file-read, file-write, library-load, reverse-shell, uploadksshellfile-readksushellkubectlshell, uploadlastfile-readlastbfile-readlatexshelllatexmkfile-read, inherit, shellld.soshellldconfiglibrary-loadlessshelllftpshelllinksfile-readlnprivilege-escalationloginctlshelllogrotatefile-write, shelllogsaveshelllookfile-readlpuploadltracefile-read, file-write, shellluabind-shell, download, file-read, file-write, reverse-shell, shell, uploadlualatexinheritluatexinheritlwp-downloaddownload, file-read, file-writelwp-requestfile-readlxdshellm4command, file-read, shellmailshellmakefile-read, file-write, shellmanfile-read, inherit, shellmawkshellminicomshellmorefile-read, shellmosh-servershellmosquittofile-readmountprivilege-escalationmsfconsoleinheritmsgattribfile-readmsgcatfile-readmsgconvfile-readmsgfilterfile-read, shellmsgmergefile-readmsguniqfile-readmtrfile-readmultitimeshellmuttfile-readmvfile-write, privilege-escalationmypyfile-writemysqllibrary-load, shellnanoshellnasmfile-readnawkshellncbind-shell, download, reverse-shell, uploadncdushellncftpshellneedrestartinheritneofetchfile-read, shellnftfile-readnginxdownload, library-load, uploadniceshellnlfile-readnmfile-readnmapfile-read, file-write, inherit, shellnodebind-shell, download, file-read, file-write, reverse-shell, shell, uploadnohupshellnpmshellnrofffile-read, shellnsentershellntpdatefile-readnvimfile-read, inheritoctavefile-read, file-write, shellodfile-readopencodecommand, inheritopenssldownload, file-read, file-write, library-load, reverse-shell, uploadopenvpnfile-read, shellopenvtcommandopkgshellpandocfile-read, file-write, inheritpasswdprivilege-escalationpastefile-readpaxfile-readpdbinheritpdflatexshellpdftexshellperfshellperldownload, file-read, reverse-shell, shell, uploadperlbugshellpexecshellpgfile-read, shellphpcommand, download, file-read, file-write, reverse-shell, shell, uploadpicshellpicoshellpidstatshellpipinherit, shellpipxinheritpkexecshellpkgcommandplymouthshellpodmanshellpoetryinheritposhshellprfile-readprocmailcommandpryinheritpsftpshellpsqlinherit, shellptxfile-readpuppetfile-read, file-write, shellpwshfile-writepygmentizefile-readpyrightfile-readpythondownload, file-read, file-write, library-load, reverse-shell, shell, uploadqpdffile-readrshellrakefile-read, inheritrangershellrcshellreadelffile-readredfile-read, file-write, shellredcarpetfile-readredisfile-writeresticcommand, shell, uploadrevfile-readrloginuploadrlwrapfile-write, shellrpmcommand, inherit, shellrpmdbinherit, shellrpmqueryinherit, shellrpmverifyinherit, shellrsyncshellrsyslogdcommandrtorrentshellrubydownload, file-read, file-write, library-load, reverse-shell, shell, uploadrun-mailcapinheritrun-partsshellrunscriptshellrustcfile-write, inheritrustdocfile-writerustfmtfile-readrustupcommand, shellrvimfile-read, inheritsashshellscanmemshellscpshellscreenfile-writescriptfile-write, shellscrotshellsedfile-write, shellserviceshellsetarchshellsetcapprivilege-escalationsetfaclprivilege-escalationsetlockshellsftpdownload, shell, uploadsgshellshredfile-writeshuffile-read, file-writeslshshellsmbclientdownload, uploadsnapcommandsocatbind-shell, download, file-read, file-write, reverse-shell, shell, uploadsocketbind-shell, reverse-shellsoelimfile-readsoftlimitshellsortfile-read, file-writesplitfile-read, file-write, shellsqlite3file-write, shellsqlmapinheritssfile-readsshfile-read, shellssh-agentshellssh-copy-idfile-read, file-writessh-keygenlibrary-loadssh-keyscanfile-readsshfscommand, shellsshpassshellsshuttleshellstart-stop-daemonshellstdbufshellstracefile-write, shellstringsfile-readsushellsudoshellsysctlfile-readsystemctlshellsystemd-resolveinheritsystemd-runshelltacfile-readtailfile-readtailscaleuploadtardownload, file-read, file-write, shell, uploadtaskshelltasksetshelltaskshshelltblfile-readtclshlibrary-load, reverse-shell, shelltcpdumpcommand, file-writetcshfile-writetdbtoolshellteefile-writetelnetreverse-shell, shellterraformfile-readtexshelltftpdownload, uploadticfile-readtimeshelltimedatectlinherittimeoutshelltmateshelltmuxfile-read, shelltopshelltorifyshelltorsocksshelltrofffile-readtscfile-writetsharkinheritulfile-readunexpandfile-readuniqfile-readunshareshellunsquashfsprivilege-escalationunzipprivilege-escalationupdate-alternativesfile-writeurlgetfile-readuuencodefile-readuvshellvagrantinheritvalgrindshellvarnishncsafile-writevishellviewfile-read, inheritvigrinheritvimfile-read, inheritvimdifffile-read, inheritvipwinheritvirshcommand, file-writevolatilityinheritw3mfile-readwallfile-readwatchshellwcfile-readwg-quickshellwgetdownload, file-read, file-write, shell, uploadwhiptailfile-readwhoisdownload, uploadwiresharkfile-write, inheritwishinheritxargsfile-read, shellxdg-user-dirshellxdotoolshellxelatexshellxetexshellxmodmapfile-readxmorefile-readxpadfile-readxxdfile-read, file-writexzfile-readyarnshellyashshellyelpfile-readyt-dlpshellyumcommand, download, inheritzathurashellzcatfile-readzgrepfile-readziccommandzipshellzlessinheritzshdownload, file-read, file-write, inherit, reverse-shell, uploadzsoelimfile-readzyppershell