Identifier / Programs / Linux and Unix
stdbuf
Run a command with modified buffering operations for its standard streams. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How stdbuf is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-i0Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for stdbuf.
1 documented command
The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for stdbuf. The identifier reads the line that runs stdbuf.
What detects it
Everyday use
Change stdin buffer size to 512 KiB
stdbuf --input 512K commandIdentifyChange stdout buffer to line-buffered
stdbuf --output L commandIdentifyChange stderr buffer to unbuffered
stdbuf --error 0 commandIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.