CmdID / Programs / Linux and Unix
lastb
List last logged in users. tldr-pages
GTFOBins file-read 1 Sigma rule name it 1 documented command
How lastb is abused
file-read
-a-fEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for lastb.
1 documented command
GTFOBins documents lastb with the commands of last.
file-read unprivileged, with sudo, as SUID
The output might be corrupted or incomplete if the file does not follow the expected database format.
last -a -f /path/to/input-fileTrips 3 Sigma rules: lowLocal System Accounts Discovery - MacOs by Alejandro Ortuno, oscd.community; lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad; informationalSystem Network Connections Discovery - MacOs by Daniil Yugoslavskiy, oscd.community
The command CmdID reads trips a Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for lastb. CmdID reads the line that runs last.
What detects it
Everyday use
List last logged in users
sudo lastbIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
List all last logged in users since a given time
sudo lastb --since YYYY-MM-DDIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
List all last logged in users until a given time
sudo lastb --until YYYY-MM-DDIdentifyTrips 1 Sigma rule: lowLocal System Accounts Discovery Attempt - Linux by Alejandro Ortuno, oscd.community, CheraghiMilad
Of the 3 examples CmdID reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.