Identifier / Programs / Linux and Unix
tee
Read from stdin and write to stdout and files (or commands). tldr-pages
GTFOBins file-write 1 documented command
How tee is abused
file-write
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tee.
1 documented command
file-write unprivileged, with sudo, as SUID
Use -a to append data to exising files.
echo DATA | tee /path/to/output-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tee. The identifier reads the line that runs tee.
Everyday use
Copy stdin to each file, and also to stdout
echo "example" | tee path/to/fileIdentifyAppend to the given files, do not overwrite
echo "example" | tee --append path/to/fileIdentifyPrint stdin to the terminal, and also pipe it into another program for further processing
echo "example" | tee /dev/tty | xargs printf "[%s]"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of tee
-aAppend to files-iIgnore SIGINT