Identifier / Programs / Linux and Unix
xargs
Execute a command with piped arguments coming from another command, a file, etc. The input is treated as a single block of text and split into separate pieces on spaces, tabs, newlines, and end-of-file. tldr-pages
GTFOBins file-read, shell 1 ATT&CK technique 4 documented commands
How xargs is abused
file-read
-aRead arguments from FILE, don't close stdin toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-aRead arguments from FILE, don't close stdin toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-oOpen tty for COMMAND's stdin (default /dev/null) toybox-aRead arguments from FILE, don't close stdin toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for xargs.
4 documented commands
file-read unprivileged, with sudo, as SUID
xargs -a /path/to/input-file -0shell unprivileged, with sudo, as SUID
xargs -a /dev/null /bin/shAs SUID:
xargs -a /dev/null /bin/sh -pshell unprivileged, with sudo, as SUID
xargs -a /dev/null /bin/shAs SUID:
xargs -a /dev/null /bin/sh -pshell unprivileged, with sudo, as SUID
echo x | xargs -o -a /dev/null /bin/shAs SUID:
echo x | xargs -o -a /dev/null /bin/sh -pNone of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for xargs. The identifier reads the line of each that runs xargs.
What detects it
Everyday use
Run a command using the input data as arguments
arguments_source | xargs commandIdentifyRun multiple chained commands on the input data
arguments_source | xargs sh -c "command1 && command2 | command3"IdentifyExecute a new command with each argument
arguments_source | xargs --max-args 1 commandIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of xargs
-0Each argument is NULL terminated, no whitespace or quote processing-a FILERead arguments from FILE, don't close stdin-E STRStop at line matching string-n STRMax number of arguments per command-oOpen tty for COMMAND's stdin (default /dev/null)-PParallel processes (default 1)-pPrompt for y/n from tty before running each command-rDon't run with empty input (otherwise always run command once)-s STRSize in bytes per command line-tTrace, print command line to stderr--process-slot-var NAMESet environment variable NAME in children