CmdID / Programs / Linux and Unix

ed

The original Unix text editor. tldr-pages

GTFOBins file-read, file-write, shell 3 Sigma rules name it 3 documented commands

How ed is abused

documented by GTFOBins

file-read

file-write

shell

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ed.

3 documented commands

from GTFOBins, each read by CmdID

file-read unprivileged, with sudo, as SUID

ed /path/to/input-file
,p
q

Identify

file-write unprivileged, with sudo, as SUID

ed /path/to/output-file
a
DATA
.
w
q

Identify

shell unprivileged, with sudo, as SUID

ed
!/bin/sh
q

Identify

None of the 3 commands CmdID reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ed. CmdID reads the line of each that runs ed.

What detects it

Sigma process creation rules

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery Attempt - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

Everyday use

from tldr-pages, CC BY 4.0

Start an interactive editor session with an empty document

edIdentify

Start an interactive editor session with an empty document and a specific prompt

ed --prompt '> 'Identify

Start an interactive editor session with user-friendly errors

ed --verboseIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

ed

How ed is abused

3 documented commands

What detects it

Everyday use

Other programs abused for file-read