Identifier / Programs / Linux and Unix
yt-dlp
A youtube-dl fork with additional features and fixes. Download videos from YouTube and other websites. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How yt-dlp is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
--execEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for yt-dlp.
1 documented command
shell unprivileged, with sudo
The URL must point to a valid YouTube video which will be actually downloaded.
yt-dlp 'https://www.youtube.com/watch?v=xxxxxxxxxxx' --exec '/bin/sh #'The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for yt-dlp. The identifier reads the line that runs yt-dlp.
What detects it
Everyday use
Download a video or playlist (with the default options from command below)
yt-dlp "https://www.youtube.com/watch?v=oHg5SJYRHA0"IdentifyList the available downloadable formats for a video
yt-dlp --list-formats "https://www.youtube.com/watch?v=oHg5SJYRHA0"IdentifyDownload a video or playlist using the best MP4 video available (default is "bv\*+ba/b")
yt-dlp --format "bv*[ext=mp4]+ba[ext=m4a]/b[ext=mp4]" "https://www.youtube.com/watch?v=oHg5SJYRHA0"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.