ash explained: GTFOBins abuse and Sigma rules

How ash is abused

documented by GTFOBins

file-write

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ash.

2 documented commands

from GTFOBins, each read by CmdID

file-write unprivileged, with sudo, as SUID

ash -c 'echo DATA >/path/to/output-file'

Identify

As SUID:

ash -p -c 'echo DATA >/path/to/output-file'

shell unprivileged, with sudo, as SUID

ash

Identify

As SUID:

ash -p

None of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ash. CmdID reads the line of each that runs ash.

What detects it

Sigma process creation rules

highSuspicious Invocation of Shell via RsyncFlorian Roth

mediumSuspicious Child Process of SAP NetWeaver - LinuxElastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

mediumShell Spawned by Celery Worker ProcessJennifer Batina

ash

How ash is abused

2 documented commands

What detects it

Other programs abused for file-write