CmdID

CmdID / Commands

mktemp

Safely create a new file "DIR/TEMPLATE" and print its name. toybox

On Linux, macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Safely create a new file "DIR/TEMPLATE" and print its name. Each X in TEMPLATE is replaced with a random printable character. The default TEMPLATE is tmp.XXXXXXXXXX.

mktemp [-dqtu] [-p DIR] [TEMPLATE]
-dCreate directory instead of file (--directory)
-p DIRPut new file in DIR (--tmpdir)
-qQuiet, no error messages
-tPrefer $TMPDIR > DIR > /tmp (default DIR > $TMPDIR > /tmp)
-uDon't create anything, just print what would be created

Several platforms

from tldr-pages, CC BY 4.0

Create a temporary file or directory.

Create an empty temporary file and print its absolute path

mktempIdentify

Use a custom directory if $TMPDIR is not set (the default is platform-dependent, but usually /tmp)

mktemp -p /path/to/temporary_directoryIdentify
-pPut new file in DIR (--tmpdir) toybox

Use a custom path template (Xs are replaced with random alphanumeric characters)

mktemp /tmp/example.XXXXXXXXIdentify

Use a custom file name template

mktemp -t example.XXXXXXXXIdentify
-tPrefer $TMPDIR > DIR > /tmp (default DIR > $TMPDIR > /tmp) toybox

Create an empty temporary directory and print its absolute path

mktemp -dIdentify
-dCreate directory instead of file (--directory) toybox

Linux

from tldr-pages, CC BY 4.0

Create a temporary file or directory.

Create an empty temporary file and print its absolute path

mktempIdentify

Use a custom directory (defaults to $TMPDIR, or /tmp)

mktemp --tmpdir=/path/to/temporary_directoryIdentify

Use a custom path template (Xs are replaced with random alphanumeric characters)

mktemp /tmp/example.XXXXXXXXIdentify

Use a custom file name template

mktemp -t example.XXXXXXXXIdentify
-tPrefer $TMPDIR > DIR > /tmp (default DIR > $TMPDIR > /tmp) toybox

Create an empty temporary file with the given suffix and print its absolute path

mktemp --suffix .extIdentify

Create an empty temporary directory and print its absolute path

mktemp --directoryIdentify

Print the name of a temporary file or directory without actually creating it

mktemp --dry-runIdentify

macOS

from tldr-pages, CC BY 4.0

Create a temporary file or directory.

Create an empty temporary file and print its absolute path

mktempIdentify

Use a custom directory (defaults to the output of getconf DARWIN_USER_TEMP_DIR, or /tmp)

mktemp --tmpdir /path/to/temporary_directoryIdentify

Use a custom path template (Xs are replaced with random alphanumeric characters)

mktemp /tmp/example.XXXXXXXXIdentify

Use a custom file name prefix

mktemp -t exampleIdentify
-tPrefer $TMPDIR > DIR > /tmp (default DIR > $TMPDIR > /tmp) toybox

Create an empty temporary directory and print its absolute path

mktemp --directoryIdentify

What detects it

Sigma process creation rules that name mktemp
mediumSuspicious Execution via macOS Script EditorTim Rauch (rule), Elastic (idea)