Identifier / Programs / Linux and Unix

tcsh

C shell with file name completion and command-line editing. tldr-pages

GTFOBins file-write 4 Sigma rules name it 2 documented commands

How tcsh is abused

documented by GTFOBins

file-write

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tcsh.

2 documented commands

from GTFOBins, each read by the identifier

file-write unprivileged, with sudo, as SUID

tcsh -c 'echo DATA >/path/to/output-file'

Identify

As SUID:

tcsh -bc 'echo DATA >/path/to/output-file'

shell unprivileged, with sudo, as SUID

tcsh

Identify

As SUID:

tcsh -b

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tcsh. The identifier reads the line of each that runs tcsh.

What detects it

Sigma process creation rules

highSuspicious Invocation of Shell via RsyncFlorian Roth

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumShell Spawned by Celery Worker ProcessJennifer Batina

mediumSuspicious Browser Child Process - MacOSSohan G (D4rkCiph3r)

Everyday use

from tldr-pages, CC BY 4.0

Start an interactive shell session

tcshIdentify

Start an interactive shell session without loading startup configs

tcsh -fIdentify

Execute specific commands

tcsh -c "echo 'tcsh is executed'"Identify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

tcsh

How tcsh is abused

2 documented commands

What detects it

Everyday use

Other programs abused for file-write