Identifier / Programs / Linux and Unix
uniq
Output the unique lines from an input or file. Since it does not detect repeated lines unless they are adjacent, we need to sort them first. tldr-pages
GTFOBins file-read 1 documented command
How uniq is abused
file-read
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for uniq.
1 documented command
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by squashing multiple adjacent lines.
uniq /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for uniq. The identifier reads the line that runs uniq.
Everyday use
Display each line once
sort path/to/file | uniqIdentifyDisplay only unique lines
sort path/to/file | uniq --uniqueIdentifyDisplay only duplicate lines
sort path/to/file | uniq --repeatedIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of uniq
-cShow counts before each line-dShow only lines that are repeated-uShow only lines that are unique-iIgnore case when comparing lines-zLines end with \0 not \n-w MAXCHARSCompare maximum X chars per line-f FIELDSIgnore first X fields-s CHARIgnore first X chars