Identifier / Programs / Linux and Unix

yarn

JavaScript and Node.js package manager alternative. tldr-pages

GTFOBins shell 1 ATT&CK technique 3 documented commands

How yarn is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

exec

shell T1059.004 Command and Scripting Interpreter: Unix Shell

--cwd

shell T1059.004 Command and Scripting Interpreter: Unix Shell

xxx

--cwd

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for yarn.

3 documented commands

from GTFOBins, each read by the identifier

shell unprivileged, with sudo

yarn exec /bin/sh

Identify

shell unprivileged, with sudo

echo '{"scripts": {"preinstall": "/bin/sh"}}' >package.json
yarn --cwd .

Identify

shell unprivileged, with sudo

echo '{"scripts": {"xxx": "/bin/sh"}}' >package.json
yarn --cwd . xxx

Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for yarn. The identifier reads the line of each that runs yarn.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Install a module globally

yarn global add module_nameIdentify

Install all dependencies referenced in the package.json file (the install is optional)

yarn installIdentify

Install a module and save it as a dependency to the package.json file (add --dev to save as a dev dependency)

yarn add module_name@versionIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

yarn

How yarn is abused

3 documented commands

What detects it

Everyday use

Other programs abused for shell