Identifier / Programs / Linux and Unix
sed
Edit text in a scriptable manner. tldr-pages
GTFOBins file-write, shell 2 Sigma rules name it 1 ATT&CK technique 4 documented commands
How sed is abused
file-write
-nNo default output (use the p command to output matched lines) toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-nNo default output (use the p command to output matched lines) toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sed.
4 documented commands
file-read unprivileged, with sudo, as SUID
sed '' /path/to/input-fileTrips no Sigma process-creation rule.
file-write unprivileged, with sudo, as SUID
sed -n '1s/.*/DATA/w /path/to/output-file' /etc/hostsTrips 1 Sigma rule: mediumPotential Suspicious Change To Sensitive/Critical Files by @d4ns4n_ (Wuerth-Phoenix)
shell unprivileged, with sudo, as SUID
sed -n '1e exec /bin/sh 1>&0' /etc/hostsTrips 1 Sigma rule: mediumPotential Suspicious Change To Sensitive/Critical Files by @d4ns4n_ (Wuerth-Phoenix)
2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sed. The identifier reads the line of each that runs sed.
What detects it
Everyday use
Replace all apple (basic regex) occurrences with mango (basic regex) in all input lines and print the result to stdout
command | sed 's/apple/mango/g'IdentifyExecute a specific script file and print the result to stdout
command | sed -f path/to/script.sedIdentifyPrint just a first line to stdout
command | sed -n '1p'IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of sed
-e SCRIPTAdd SCRIPT to list-f SCRIPT_FILEAdd contents of SCRIPT_FILE to list-iEdit each file in place (-iEXT keeps backup file with extension EXT)-nNo default output (use the p command to output matched lines)-rUse extended regular expression syntax-EPOSIX alias for -r-sTreat input files separately (implied by -i)-zUse \0 rather than \n as input line separator