Identifier / Programs / Linux and Unix
tcpdump
Dump traffic on a network. tldr-pages
GTFOBins command, file-write 1 Sigma rule name it 3 documented commands
How tcpdump is abused
command
-ln-i-w-W-G-zfile-write
-ln-i-w-c-ZEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tcpdump.
3 documented commands
command unprivileged, with sudo
This requires some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.
echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /path/to/temp-fileWith sudo:
echo /path/to/command >/path/to/temp-file
chmod +x /path/to/temp-file
tcpdump -ln -i lo -w /dev/null -W 1 -G 1 -z /path/to/temp-file -Z rootTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
command unprivileged, with sudo
This require some traffic to be actually captured. Also note that the command-argument string is both passed to the command and written as file, hence some restrictions apply.
tcpdump -ln -i lo -w 'command-argument' -W 1 -G 1 -z /path/to/commandTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
file-write unprivileged, with sudo, as SUID
This saves the packet dump (count is 1) from the loopback interface to a file. To trigger the capture use something like:
nc -u localhost 1 <<<DATAWhile user is the owner of the packet dump file, the invoking user must be able to capture traffic on the device.
tcpdump -ln -i lo -w /path/to/output-file -c 1 -Z userTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
All 3 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tcpdump. The identifier reads the line of each that runs tcpdump.
What detects it
Everyday use
List available network interfaces
tcpdump --list-interfacesIdentifyTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
Capture the traffic of a specific interface
sudo tcpdump --interface eth0IdentifyTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
Capture all TCP traffic showing contents (ASCII) in console
sudo tcpdump -A tcpIdentifyTrips 1 Sigma rule: informationalNetwork Sniffing - MacOs by Alejandro Ortuno, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.