Identifier / Programs / Linux and Unix

watch

Execute a program periodically and monitor the output in full-screen mode. tldr-pages

GTFOBins shell 1 ATT&CK technique 2 documented commands

How watch is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-xExec command directly (without "sh -c") toybox

-c

shell T1059.004 Command and Scripting Interpreter: Unix Shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for watch.

2 documented commands

from GTFOBins, each read by the identifier

shell unprivileged, with sudo, as SUID

watch -x /bin/sh -c 'reset; exec /bin/sh 1>&0 2>&0'

Identify

As SUID:

watch -x /bin/sh -p -c 'reset; exec /bin/sh -p 1>&0 2>&0'

shell unprivileged, with sudo, as SUID

watch 'reset; exec /bin/sh 1>&0 2>&0'

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for watch. The identifier reads the line of each that runs watch.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Repeatedly run a command and show the result

watch commandIdentify

Re-run a command every 60 seconds

watch --interval 60 commandIdentify

Monitor disk space, highlighting differences as they appear

watch --differences dfIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

5 in toybox

Show every option of watch

-n SECNumber of seconds between repeats (default 2.0)

-tDon't print header

-eExit on error

-bBeep on command error

-xExec command directly (without "sh -c")