Identifier / Programs / Linux and Unix

sudo

Execute a single command as the superuser or another user. tldr-pages

GTFOBins shell 3 Sigma rules name it 2 ATT&CK techniques 1 documented command

How sudo is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sudo.

1 documented command

from GTFOBins, each read by the identifier

shell with sudo

sudo /bin/sh

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sudo. The identifier reads the line that runs sudo.

What detects it

Sigma process creation rules

lowLinux Sudo Chroot ExecutionSwachchhanda Shrawn Poudel (Nextron Systems)

highTriple Cross eBPF Rootkit Execve HijackNasreddine Bencherchali (Nextron Systems)

highTriple Cross eBPF Rootkit Install CommandsNasreddine Bencherchali (Nextron Systems)

T1059.004Command and Scripting Interpreter: Unix Shell

T1068Exploitation for Privilege Escalation

Everyday use

from tldr-pages, CC BY 4.0

Run a command as the superuser

sudo less /var/log/syslogIdentify

Edit a file as the superuser with your default editor

sudo --edit /etc/fstabIdentify

Run a command as another user and/or group

sudo --user user --group group id -aIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

sudo

How sudo is abused

1 documented command

What detects it

Everyday use

Other programs abused for shell