CmdID / Programs / Linux and Unix
find
Find files or directories under a directory tree, recursively. tldr-pages
GTFOBins file-read, file-write, shell 6 Sigma rules name it 2 ATT&CK techniques 3 documented commands
How find is abused
file-read
-execRun command with path toyboxfile-write
-fprintf-quitExit immediately toyboxshell T1059.004 Command and Scripting Interpreter: Unix Shell
-execRun command with path toybox-quitExit immediately toyboxEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for find.
3 documented commands
file-read unprivileged, with sudo, as SUID
This uses cat to actually read the file, but since permissions are not dropped, it's executed with the same privileges as find.
find /path/to/input-file -exec cat {} \;Trips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
file-write unprivileged, with sudo, as SUID
DATA is a format string, it supports some escape sequences.
find / -fprintf /path/to/output-file DATA -quitTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
shell unprivileged, with sudo, as SUID
find . -exec /bin/sh \; -quitAs SUID:
find . -exec /bin/sh -p \; -quitTrips 2 Sigma rules: highShell Execution via Find - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.); informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
All 3 commands CmdID reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for find. CmdID reads the line of each that runs find.
What detects it
Everyday use
Find files by extension
find path/to/directory -name '*.ext'Identify-namefilename with wildcards toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Find files matching multiple path/name patterns
find path/to/directory -path '*/path/*/*.ext' -or -name '*pattern*'Identify-pathpath name with wildcards toybox-namefilename with wildcards toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Find directories matching a given name, in case-insensitive mode
find path/to/directory -type d -iname '*lib*'Identify-typetype is (block, char, dir, file, symlink, pipe, socket) toybox-inameignore case -name toyboxTrips 1 Sigma rule: informationalFile and Directory Discovery - Linux by Daniil Yugoslavskiy, oscd.community, CheraghiMilad
Of the 3 examples CmdID reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.
Options
Show every option of find
-HFollow command line symlinks-LFollow all symlinks-name PATTERNfilename with wildcards-inameignore case -name-path PATTERNpath name with wildcards-ipathignore case -path-user UNAMEbelongs to user UNAME-nouseruser ID not known-group GROUPbelongs to group GROUP-nogroupgroup ID not known-perm [-/]MODEpermissions (-=min /=any)-pruneignore dir contents-size N[c]512 byte blocks (c=bytes)-xdevonly this filesystem-links Nhardlink count-emptyempty files and dirs-atime N[u]accessed N units ago-truealways true-ctime N[u]created N units ago-falsealways false-mtime N[u]modified N units ago-executableaccess(X_OK) perm+ACL-inum Ninode number N-readableaccess(R_OK) perm+ACL-context PATTERNsecurity context-depthcontents before dir-samefile FILEhardlink to FILE-maxdepth Nat most N dirs down-newer FILEnewer mtime than FILE-mindepth Nat least N dirs down-newerXY FILEX=acm time > FILE's Y=acm time (Y=t: FILE is literal time)-type [bcdflps]type is (block, char, dir, file, symlink, pipe, socket)-[acm]timeare d (days, default), h (hours), m (minutes), or s (seconds).-printPrint match with newline-print0Print match with null-execRun command with path-execdirRun command in file's dir-okAsk before exec-okdirAsk before execdir-deleteRemove matching file/dir-printf FORMATPrint using format string-quitExit immediately-printf FORMATcharacters are \ escapes and: