Identifier / Programs / Linux and Unix
sg
Ast-grep is a tool for code structural search, lint, and rewriting. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How sg is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-ngEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sg.
1 documented command
shell unprivileged, with sudo
Commands can be run if the current user's group is specified, therefore no additional permissions are needed.
sg $(id -ng)With sudo:
sg rootTrips 2 Sigma rules: lowLocal System Accounts Discovery - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sg. The identifier reads the line that runs sg.
What detects it
Everyday use
Scan for possible queries using interactive mode
sg scan --interactiveIdentifyRewrite code in the current directory using patterns
sg run --pattern 'pattern' --rewrite 'replacement' --lang pythonIdentifyVisualize possible changes without applying them
sg run --pattern 'useState<number>($A)' --rewrite 'useState($A)' --lang typescriptIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.