CmdID

CmdID / Commands

pwd

Print working (current) directory. toybox

On Linux, Windows 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD
pwd [-L|-P]
-LUse shell's path from $PWD (when applicable)
-PPrint canonical absolute path

Several platforms

from tldr-pages, CC BY 4.0

Print the name of current/working directory.

Print the current directory

Print the current directory, and resolve all symlinks (i.e. show the "physical" path)

pwd --physicalIdentify

Display help

pwd --helpIdentify

Windows

from tldr-pages, CC BY 4.0

In PowerShell, this command is an alias of Get-Location. However, this command is not available on the Command Prompt (cmd). Use cd instead for similar functionality.

What detects it

Sigma process creation rules that name pwd
highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)