Identifier / Programs / Linux and Unix
top
Display dynamic real-time information about running processes. tldr-pages
GTFOBins shell 1 Sigma rule name it 1 documented command
How top is abused
shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for top.
1 documented command
shell unprivileged, with sudo
The config path might be different.
echo -e 'pipe\tx\texec /bin/sh 1>&0 2>&0' >>~/.config/procps/toprc
top
# press return twice
resetTrips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad
The command the identifier reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for top. The identifier reads the line that runs top.
What detects it
Everyday use
Start top
topIdentifyTrips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad
Do not show any idle or zombie processes
top --idle-toggleIdentifyTrips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad
Show only processes owned by given user
top --filter-only-euser usernameIdentifyTrips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.
Options
Show every option of top
-HShow threads-hUsage graphs instead of text-kFallback sort FIELDS (default -S,-%CPU,-ETIME,-PID)-oShow FIELDS (def PID,USER,PR,NI,VIRT,RES,SHR,S,%CPU,%MEM,TIME+,CMDLINE)-OAdd FIELDS (replacing PR,NI,VIRT,RES,SHR,S from default)-s SORTSort by field number (1-X, default 9)-bBatch mode (no tty)-d SECONDSDelay SECONDS between each cycle (default 3)-m LINESMaximum number of tasks to show-n NUMBERExit after NUMBER iterations-pShow these PIDs-uShow these USERs-qQuiet (no header lines)