Identifier / Programs / Linux and Unix
vi
Vim (Vi IMproved), a command-line text editor, provides several modes for different kinds of text manipulation. Pressing <i> in normal mode enters insert mode. Pressing <Esc> goes back to normal mode, which enables the use of Vim commands. tldr-pages
GTFOBins shell 4 Sigma rules name it 3 ATT&CK techniques 6 documented commands
How vi is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for vi.
6 documented commands
file-read unprivileged, with sudo, as SUID
vi /path/to/input-fileTrips no Sigma process-creation rule.
file-write unprivileged, with sudo, as SUID
Where ^[ is the escape key.
vi /path/to/output-file
iDATA
^[
wTrips no Sigma process-creation rule.
shell unprivileged, with sudo, as SUID
vi -c ':!/bin/sh' /dev/nullTrips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
shell unprivileged, with sudo, as SUID
vi -c ':shell'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
shell unprivileged, with sudo, as SUID
vi -c ':set shell=/bin/sh | shell'As SUID:
vi -c ':set shell=/bin/sh\ -p | shell'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
shell unprivileged, with sudo, as SUID
vi -c :terminal /bin/shAs SUID:
vi -c ':terminal /bin/sh -p'Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux
4 of the 6 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for vi. The identifier reads the line of each that runs vi.