Identifier / Programs / Linux and Unix
valgrind
Wrapper for a set of expert tools for profiling, optimizing, and debugging programs. Commonly used tools include memcheck, cachegrind, callgrind, massif, helgrind, and drd. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How valgrind is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for valgrind.
1 documented command
shell unprivileged, with sudo
valgrind /bin/shThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for valgrind. The identifier reads the line that runs valgrind.
What detects it
Everyday use
Use the (default) Memcheck tool to show a diagnostic of memory usage by program
valgrind programIdentifyUse Memcheck to report all possible memory leaks of program in full detail
valgrind --leak-check=full --show-leak-kinds=all programIdentifyUse the Cachegrind tool to profile and log CPU cache operations of program
valgrind --tool=cachegrind programIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.