Identifier / Programs / Linux and Unix
sysctl
List and change kernel runtime variables. tldr-pages
GTFOBins file-read 2 Sigma rules name it 2 ATT&CK techniques 2 documented commands
How sysctl is abused
file-read
-nDon't print key names toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sysctl.
2 documented commands
command with sudo, as SUID
The command is executed by root in the background when a core dump occurs.
To trigger a core dump, send the SIGQUIT signal to a process, for example:
sleep infinity &
kill -QUIT $!sysctl 'kernel.core_pattern=|/path/to/command'file-read unprivileged, with sudo, as SUID
sysctl -n "/../../path/to/input-file"None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sysctl. The identifier reads the line of each that runs sysctl.
What detects it
Everyday use
Show all available variables and their values
sysctl --allIdentifySet a changeable kernel state variable
sysctl --write section.tunable=valueIdentifyGet currently open file handlers
sysctl fs.file-nrIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of sysctl
-aShow all values-eDon't warn about unknown keys-NDon't print key values-nDon't print key names-pRead values from FILE (default /etc/sysctl.conf)-qDon't show value after write-wOnly write values (object to reading)