CmdID / Programs / Linux and Unix
bpftrace
High-level tracing language for Linux eBPF. tldr-pages
GTFOBins shell 1 ATT&CK technique 3 documented commands
How bpftrace is abused
shell T1059.004 Command and Scripting Interpreter: Unix Shell
--unsafeEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for bpftrace.
3 documented commands
shell with sudo
bpftrace --unsafe -e 'BEGIN {system("/bin/sh 1<&0");exit()}'Trips 1 Sigma rule: mediumBPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
shell with sudo
echo 'BEGIN {system("/bin/sh 1<&0");exit()}' >/path/to/temp-file
bpftrace --unsafe /path/to/temp-fileTrips 1 Sigma rule: mediumBPFtrace Unsafe Option Usage by Andreas Hunkeler (@Karneades)
2 of the 3 commands CmdID reads trip a Sigma process-creation rule; 1 trips none. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for bpftrace. CmdID reads the line of each that runs bpftrace.
What detects it
Everyday use
List all available probes
sudo bpftrace -lIdentifyRun a one-liner program (e.g. syscall count by program)
sudo bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'IdentifyRun a program from a file
sudo bpftrace path/to/fileIdentifyNone of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.