Identifier / Programs / Linux and Unix

vim

Vim (Vi IMproved), a command-line text editor, provides several modes for different kinds of text manipulation. Pressing <i> in normal mode enters insert mode. Pressing <Esc> goes back to normal mode, which enables the use of Vim commands. tldr-pages

GTFOBins file-read, inherit 4 Sigma rules name it 2 ATT&CK techniques 4 documented commands

How vim is abused

documented by GTFOBins

file-read

-c

inherit

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for vim.

4 documented commands

from GTFOBins, each read by the identifier

file-read unprivileged, with sudo, as SUID

vim -c ':redir! >/path/to/output-file | echo "DATA" | redir END | q'

Identify

Trips no Sigma process-creation rule.

inherit unprivileged, with sudo, as SUID

This allows to run Python code (...).

vim -c ':py ...'

Identify

Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux

inherit unprivileged, with sudo, as SUID

This allows to run Lua code (...).

vim -c ':lua ...'

Identify

Trips 1 Sigma rule: highVim GTFOBin Abuse - Linux by Nasreddine Bencherchali (Nextron Systems), Luc Génaux

inherit unprivileged, with sudo, as SUID

vim

Identify

Trips no Sigma process-creation rule.

2 of the 4 commands the identifier reads trip a Sigma process-creation rule; 2 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for vim. The identifier reads the line of each that runs vim.

What detects it

Sigma process creation rules

highVim GTFOBin Abuse - LinuxNasreddine Bencherchali (Nextron Systems), Luc Génaux

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

T1059Command and Scripting Interpreter

T1083File and Directory Discovery

Everyday use

from tldr-pages, CC BY 4.0

Open a file

vim path/to/fileIdentify

Open a file at a specified line number

vim +line_number path/to/fileIdentify

View Vim's help manual

<:>help<Enter>

None of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

vim

How vim is abused

4 documented commands

What detects it

Everyday use

Other programs abused for file-read