Identifier / Programs / Linux and Unix

r

r can refer to multiple commands with the same name. tldr-pages

GTFOBins shell 1 ATT&CK technique 1 documented command

How r is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

--no-save

-e

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for r.

from GTFOBins, each read by the identifier

shell unprivileged, with sudo, as SUID

R --no-save -e 'system("/bin/sh")'

This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for r. The identifier reads the line that runs r.

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

from tldr-pages, CC BY 4.0

View documentation for the R language interpreter

tldr r.langIdentify

View documentation for the Zsh command

tldr r.zshIdentify

None of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.