Identifier / Programs / Linux and Unix
unexpand
Convert spaces to tabs. tldr-pages
GTFOBins file-read 1 documented command
How unexpand is abused
file-read
-t999Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for unexpand.
1 documented command
file-read unprivileged, with sudo, as SUID
Convert sequences of (e.g., 999) spaces to tab.
unexpand -t999 /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for unexpand. The identifier reads the line that runs unexpand.
Everyday use
Convert blanks in each file to tabs, writing to stdout
unexpand path/to/fileIdentifyConvert blanks to tabs, reading from stdout
unexpandIdentifyConvert all blanks, instead of just initial blanks
unexpand --all path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.