CmdID / Programs / Linux and Unix

head

Output the first part of files. tldr-pages

GTFOBins file-read 7 Sigma rules name it 1 documented command

How head is abused

documented by GTFOBins

file-read

-c-0

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for head.

1 documented command

from GTFOBins, each read by CmdID

file-read unprivileged, with sudo, as SUID

head -c-0 /path/to/input-file

Identify

The command CmdID reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for head. CmdID reads the line that runs head.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery Attempt - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

Everyday use

from tldr-pages, CC BY 4.0

Output the first few lines of a file

head -n count path/to/fileIdentify

-nNumber of lines to copy toybox

The example CmdID reads matches no GTFOBins abuse and trips no Sigma process-creation rule.

Options

4 in toybox

Show every option of head

-n NUMNumber of lines to copy

-c NUMNumber of bytes to copy

-qNever print headers

-vAlways print headers