Identifier / Programs / Linux and Unix
update-alternatives
Conveniently maintain symbolic links to determine default commands. tldr-pages
GTFOBins file-write 1 documented command
How update-alternatives is abused
file-write
--force--installEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for update-alternatives.
1 documented command
file-write with sudo, as SUID
Write in /path/to/output-file a symlink to /path/to/temp-file.
echo DATA >/path/to/temp-file
update-alternatives --force --install /path/to/output-file x /path/to/temp-file 0The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for update-alternatives. The identifier reads the line that runs update-alternatives.
Everyday use
Add a symbolic link
sudo update-alternatives --install path/to/symlink command_name path/to/command_binary priorityIdentifyConfigure a symbolic link for java
sudo update-alternatives --config javaIdentifyRemove a symbolic link
sudo update-alternatives --remove java /opt/java/jdk1.8.0_102/bin/javaIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.