Identifier / Programs / Linux and Unix
service
Manage services by running init scripts. The full script path should be omitted (/etc/init.d/ is assumed). tldr-pages
GTFOBins shell 2 Sigma rules name it 2 ATT&CK techniques 1 documented command
How service is abused
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for service.
1 documented command
shell unprivileged, with sudo
service ../../bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for service. The identifier reads the line that runs service.
What detects it
Everyday use
List the name and status of all services
service --status-allIdentifyStart/Stop/Restart/Reload service (start/stop should always be available)
service service_name startIdentifyDo a full restart (runs script twice with start and stop)
service service_name --full-restartIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.