CmdID / Programs / Linux and Unix
getent
Get entries from Name Service Switch libraries. tldr-pages
GTFOBins privilege-escalation 2 Sigma rules name it 1 documented command
How getent is abused
privilege-escalation
shadow
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for getent.
1 documented command
privilege-escalation with sudo, as SUID
This allows to dump password hashes from the /etc/shadow file.
getent shadowTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
The command CmdID reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for getent. CmdID reads the line that runs getent.
What detects it
Everyday use
Get list of all groups
getent groupIdentifyTrips 1 Sigma rule: lowLocal Groups Discovery Attempt - Linux by Ömer Günal, Alejandro Ortuno, oscd.community
See the members of a group
getent group group_nameIdentifyTrips 1 Sigma rule: lowLocal Groups Discovery Attempt - Linux by Ömer Günal, Alejandro Ortuno, oscd.community
Get list of all services
getent servicesIdentifyOf the 3 examples CmdID reads, 2 match GTFOBins abuse or trip a Sigma process-creation rule.