Identifier / Programs / Linux and Unix

time

Measure how long a command took to run. tldr-pages

GTFOBins shell 1 ATT&CK technique 1 documented command

How time is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for time.

1 documented command

from GTFOBins, each read by the identifier

shell unprivileged, with sudo, as SUID

Note that the shell might have its own builtin time implementation, which may behave differently than the binary, which is often located at /usr/bin/time.

time /bin/sh

Identify

As SUID:

time /bin/sh -p

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for time. The identifier reads the line that runs time.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Run the command and print the time measurements to stdout

time commandIdentify

Create a very simple stopwatch (only works in Bash)

time readIdentify

None of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

2 in toybox

Show every option of time

-pPOSIX format output

-vVerbose