CmdID / Programs / Linux and Unix
nmap
Network exploration tool and security/port scanner. Some features (e.g. SYN scan) activate only when nmap is run with root privileges. tldr-pages
GTFOBins file-read, file-write, inherit, shell 3 Sigma rules name it 1 ATT&CK technique 4 documented commands
How nmap is abused
file-read
-iLfile-write
-oGinherit
--scriptshell T1059.004 Command and Scripting Interpreter: Unix Shell
--interactiveEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for nmap.
4 documented commands
file-read unprivileged, with sudo, as SUID
The file is actually parsed as a list of hosts/networks, lines are leaked through error messages.
nmap -iL /path/to/input-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
file-write unprivileged, with sudo, as SUID
The payload appears inside the regular nmap output.
nmap -oG=/path/to/output-file DATATrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
inherit unprivileged, with sudo, as SUID
This allows to run Lua code (...).
echo '...' >/path/to/temp-file
nmap --script=/path/to/temp-fileTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
shell unprivileged, with sudo, as SUID
nmap --interactive
!/bin/shTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
All 4 commands CmdID reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for nmap. CmdID reads the line of each that runs nmap.
What detects it
Everyday use
Scan the top 1000 ports of a remote host with various verbosity levels
nmap -v1 ip_or_hostnameIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Run a ping sweep over an entire subnet or individual hosts very aggressively
nmap -T5 -sn 192.168.0.0/24IdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Enable OS detection, version detection, script scanning, and traceroute of hosts from a file
sudo nmap -A -iL path/to/file.txtIdentifyTrips 2 Sigma rules: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure]); lowMacOS Network Service Scanning by Alejandro Ortuno, oscd.community
Of the 3 examples CmdID reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.