Identifier / Programs / Linux and Unix
tmux
Terminal multiplexer. It allows multiple sessions with windows, panes, and more. tldr-pages
GTFOBins file-read, shell 1 ATT&CK technique 3 documented commands
How tmux is abused
file-read
-fshell T1059.004 Command and Scripting Interpreter: Unix Shell
-cshell T1059.004 Command and Scripting Interpreter: Unix Shell
-SEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tmux.
3 documented commands
file-read unprivileged, with sudo, as SUID
The file is read and parsed as a tmux configuration file, part of the first invalid line is returned in an error message.
tmux -f /path/to/input-fileshell unprivileged, with sudo, as SUID
tmux -c /bin/shshell unprivileged, with sudo, as SUID
Provided to have enough permissions to access the socket (e.g., /tmp/tmux-xxx/default).
tmux -S /path/to/socketNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tmux. The identifier reads the line of each that runs tmux.