Sources and licences

The Ceplin Command Identifier writes no descriptions of its own. Every description of a program, an option, a cmdlet or a .NET member is quoted from a published reference, shortened to its first sentence, and labelled with the reference it comes from. What a command amounts to is left to the Sigma rule titles and the MITRE ATT&CK technique names. The rest is fact: the processes a line starts, the script under -EncodedCommand, the addresses in it.

Privacy

The identifier runs in your browser and the command you paste is not sent anywhere. Privacy and security explains how, and how to check it.

Versions

The references are read from each project's repository at the commit below, and the indexes in data/ are rebuilt from them now and then, not live. The newest rebuild is from 2 Nov 2026. Each version links to the exact state of the source that was read.

Detections

Sigma (SigmaHQ/sigma)

Detection Rule License (DRL) 1.1, the SigmaHQ rule authors. The process creation rules (title, level, author, ATT&CK tags, detection, condition) are evaluated against the command line; they are in data/binaries.dat on this site. As the DRL requires, every rule shown, and every match, names the rule's authors and links to the rule. github.com/SigmaHQ/sigma

LOLBAS (LOLBAS-Project/LOLBAS) and GTFOBins (GTFOBins/GTFOBins.github.io)

GPL-3.0, the LOLBAS Project and GTFOBins and their contributors; LOLBAS's terms and disclaimers are in its notice. The identifier takes facts only: binary names, abuse categories and function names, the option names each documented abuse uses, and ATT&CK ids; each match links to the project's page for the write-up. The program pages also show each project's documented commands, with LOLBAS's descriptions and the author of each LOLBAS entry, and GTFOBins' notes, from LOLBAS at commit 2056cb766250 of 2026-09-26 and GTFOBins at commit acd524623f9c of 2026-05-27. Changes: their Markdown is shown as formatted text. The identifier reads each LOLBAS command with its placeholders filled in (a URL as https://example.com/file, a path as C:\Data\file) and shows the Sigma rules it trips. What the pages show is in static/lolbas-gtfobins-commands.json.gz, the form they are built from. It comes with no warranty; see the licence.

LOLDrivers (magicsword-io/LOLDrivers) and LOLRMM (magicsword-io/LOLRMM)

Apache License 2.0, MagicSword. Each driver's category, ATT&CK id, file metadata and sample hashes (LOLDrivers); each remote management tool's name, website and the first sentence of its description (LOLRMM). Changes: descriptions reduced to their first sentence.

MITRE ATT&CK®

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. The name of each Enterprise technique is shown beside its id. Its licence: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.” The licence and its disclaimers are in static/licences/MITRE-ATTACK.txt; terms of use.

Programs and options

Microsoft Windows commands reference (MicrosoftDocs/windowsserverdocs)

CC BY 4.0, Copyright (c) Microsoft Corporation. Each command's opening description and the first sentence of each parameter's description. Changes: markdown and HTML removed, text shortened to one sentence.

Microsoft PowerShell reference (MicrosoftDocs/PowerShell-Docs)

CC BY 4.0, Copyright (c) Microsoft Corporation. The Windows PowerShell 5.1 cmdlet pages (synopsis, aliases, the first sentence of each parameter's description) and about_PowerShell_exe. Changes: markdown removed, text shortened to one sentence.

PowerShell module references (MicrosoftDocs/windows-powershell-docs, office-docs-powershell, microsoftgraph-docs-powershell)

CC BY 4.0, Copyright (c) Microsoft Corporation. Each cmdlet's synopsis, the first sentence of each parameter's description, and parameter aliases, for Windows Server, Exchange, Teams and Microsoft Graph. Changes: markdown removed, text shortened to one sentence.

Microsoft .NET API reference (dotnet/dotnet-api-docs)

CC BY 4.0, Copyright (c) .NET Foundation and Contributors. The summary of each type and member in the namespaces scripts use most (System, System.Net, System.IO, System.Diagnostics, System.Reflection and others). Changes: XML markup removed.

tldr-pages (tldr-pages/tldr)

CC BY 4.0, Copyright (c) the tldr-pages team and contributors. Page summaries and up to three examples per page, shown on the program pages. Changes: markdown removed, placeholders unwrapped, short/long option pairs reduced to the long form.

xCyclopedia (strontic/xcyclopedia)

MIT License, Copyright (c) 2020 strontic. File description, product, company, original file name, folder, signer, file version and MD5, SHA-1 and SHA-256 hashes of Windows executables and libraries, read by the identifier and shown on the program pages. VirusTotal fields not included.

toybox (landley/toybox)

0BSD, Copyright (C) 2006, 2019 Rob Landley. Help text for Linux commands.

Cloud and container CLIs

AWS Command Line Interface (aws/aws-cli)

Apache License 2.0, Copyright Amazon.com, Inc. or its affiliates. Service, operation and parameter documentation from the service models it carries, and the CLI's own commands and options. Changes: HTML removed, descriptions reduced to their first sentence.

Azure CLI (Azure/azure-cli, azure-cli-extensions, azure-devops-cli-extension) and Knack (microsoft/knack)

MIT License, Copyright (c) Microsoft Corporation: Azure CLI, its extensions, the Azure DevOps extension and Knack. Command, group and parameter help. Changes: descriptions reduced to their first sentence.

Docker CLI, Docker Compose and Docker Buildx (docker/cli, docker/compose, docker/buildx)

Apache License 2.0, Copyright Docker, Inc.; the notices of Docker CLI and Docker Compose. Command descriptions, aliases and options from the generated command references. Changes: descriptions reduced to their first sentence.

Kubernetes documentation (kubernetes/website) and kubectl (kubernetes/kubectl)

The kubectl reference is CC BY 4.0, The Kubernetes Authors, from the Kubernetes documentation: each command's description and options. Changes: reduced to their first sentence. Command aliases are read from kubectl's source (Apache License 2.0).

Network devices

NetScaler ADC: NITRO Go SDK (citrix/adc-nitro-go) and the NetScaler ADC Ansible collection (netscaler/ansible-collection-netscaleradc)

Apache License 2.0, Copyright Citrix Systems, Inc., and MIT License, Copyright (c) Cloud Software Group, Inc. Each resource's command group and the first sentence of each field's description.

FortiOS: FortiOS Terraform provider (fortinetdev/terraform-provider-fortios)

Mozilla Public License 2.0, Copyright Fortinet, Inc. Each resource's description and the first sentence of each argument's, the arguments marked sensitive, and the CLI path of each resource. The data file data/fortios.dat on this site is MPL-2.0 covered material, in its source form; the licence is at mozilla.org/MPL/2.0.

Cisco IOS XE: IOS XE Terraform provider (CiscoDevNet/terraform-provider-iosxe)

Mozilla Public License 2.0, Copyright Cisco Systems, Inc. Each resource's path in the configuration model, each attribute's description, and which are sensitive. The data file data/iosxe.dat on this site is MPL-2.0 covered material, in its source form; the licence is at mozilla.org/MPL/2.0. Cisco's YANG models are not used.

Junos: Juniper Junos YANG models (Juniper/yang)

Apache License 2.0, Copyright Juniper Networks, Inc. The configuration tree and each node's description.

This site

Space Grotesk (floriankarsten/space-grotesk) and IBM Plex Mono (IBM/plex)

SIL Open Font License 1.1, Copyright 2020 The Space Grotesk Project Authors and Copyright 2017 IBM Corp. Served from this site; the licences are in static/fonts/.

Go (golang/go)

BSD 3-Clause, Copyright 2009 The Go Authors. The engine is written in Go and compiled with it, so it holds Go's runtime and standard library, and wasm_exec.js, which starts it, is Go's own. The licence is at static/LICENSE-Go.txt.

Licence texts

Each licence and notice above, as its project publishes it, is served in static/licences/: GPL-3.0, LOLBAS's notice, DRL 1.1, MITRE ATT&CK, Apache 2.0, the MIT licences of xCyclopedia, Azure CLI, its extensions, the Azure DevOps extension, Knack and the NetScaler collection, and Docker's notices for its CLI and Compose. CC BY 4.0 and MPL-2.0 are linked where they apply.

Logo and icons

Ceplin's own: the logo, and icons from Ceplin's presentation material.

Not affiliated

Ceplin is not affiliated with, endorsed by or sponsored by any of the projects or companies above. Names are used to say where information comes from.