Identifier / Programs / Linux and Unix
su
Switch shell to another user. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How su is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-cCommand line to pass to -s shell (ala sh -c "CMD") toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for su.
1 documented command
shell with sudo
su -c /bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for su. The identifier reads the line that runs su.
What detects it
Everyday use
Switch to superuser (requires the root password)
suIdentifySwitch to a given user (requires the user's password)
su usernameIdentifySwitch to a given user and simulate a full login shell
su - usernameIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of su
-s SHELLShell to use (default is user's shell from /etc/passwd)-c CMDCommand line to pass to -s shell (ala sh -c "CMD")-lReset environment as if new login.-u UIDSwitch to UID instead of USER-gSwitch to GID (only root allowed, can be comma separated list)-pPreserve environment (except for $PATH and $IFS)