Identifier / Programs / Linux and Unix

tail

Display the last part of a file. tldr-pages

GTFOBins file-read 7 Sigma rules name it 1 documented command

How tail is abused

documented by GTFOBins

file-read

-c+0

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tail.

1 documented command

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

tail -c+0 /path/to/input-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tail. The identifier reads the line that runs tail.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

Everyday use

from tldr-pages, CC BY 4.0

Show last 10 lines in a file

tail path/to/fileIdentify

Show last 10 lines of multiple files

tail path/to/file1 path/to/file2 ...Identify

Show last 5 lines in file

tail [-5|--lines 5] path/to/fileIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

5 in toybox

Show every option of tail

-nOutput the last NUMBER lines (default 10), +X counts from start

-cOutput the last NUMBER bytes, +NUMBER counts from start

-fFollow FILE(s) by descriptor, waiting for more data to be appended

-FFollow FILE(s) by filename, waiting for more data, and retrying

-s SECONDSUsed with -F, sleep SECONDS between retries (default 1)