CmdID / Programs / Linux and Unix

expect

Script executor that interacts with other programs that require user input. tldr-pages

GTFOBins shell 1 ATT&CK technique 2 documented commands

How expect is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

-c

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for expect.

2 documented commands

from GTFOBins, each read by CmdID

file-read unprivileged, with sudo, as SUID

The file is read and parsed as an expect command file, the content of the first invalid line is returned in an error message.

expect /path/to/input-file

Identify

shell unprivileged, with sudo, as SUID

expect -c 'spawn /bin/sh;interact'

Identify

As SUID:

expect -c 'spawn /bin/sh -p;interact'

None of the 2 commands CmdID reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for expect. CmdID reads the line of each that runs expect.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

Execute an expect script from a file

expect path/to/fileIdentify

Execute a specified expect script

expect -c "commands"Identify

Enter an interactive REPL (use exit or <Ctrl d> to exit)

expect -iIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

expect

How expect is abused

2 documented commands

What detects it

Everyday use

Other programs abused for shell