Identifier / Programs / Linux and Unix
terraform
Create and deploy infrastructure as code to cloud providers. tldr-pages
GTFOBins file-read 1 documented command
How terraform is abused
file-read
console
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for terraform.
1 documented command
file-read unprivileged, with sudo, as SUID
terraform console
file("/path/to/input-file")The command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for terraform. The identifier reads the line that runs terraform.
Everyday use
Initialize a new or existing Terraform configuration
terraform initIdentifyVerify that the configuration files are syntactically valid
terraform validateIdentifyFormat configuration according to Terraform language style conventions
terraform fmtIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.