CmdID / Programs / Linux and Unix

tail

Display the last part of a file. tldr-pages

GTFOBins file-read 7 Sigma rules name it 1 documented command

How tail is abused

documented by GTFOBins

file-read

-c+0

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tail.

1 documented command

from GTFOBins, each read by CmdID

file-read unprivileged, with sudo, as SUID

tail -c+0 /path/to/input-file

Identify

The command CmdID reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tail. CmdID reads the line that runs tail.

What detects it

Sigma process creation rules

highLinux Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPrint History File ContentsFlorian Roth (Nextron Systems)

mediumAccess of Sudoers File ContentFlorian Roth (Nextron Systems)

mediumPotential Suspicious Change To Sensitive/Critical Files@d4ns4n_ (Wuerth-Phoenix)

lowLocal System Accounts Discovery Attempt - LinuxAlejandro Ortuno, oscd.community, CheraghiMilad

lowLocal Groups Discovery Attempt - LinuxÖmer Günal, Alejandro Ortuno, oscd.community

lowContainer Residence Discovery Via Proc Virtual FSSeth Hanford

Everyday use

from tldr-pages, CC BY 4.0

Show last 10 lines in a file

tail path/to/fileIdentify

Show last 10 lines of multiple files

tail path/to/file1 path/to/file2 ...Identify

Show last 5 lines in file

tail [-5|--lines 5] path/to/fileIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

5 in toybox

Show every option of tail

-nOutput the last NUMBER lines (default 10), +X counts from start

-cOutput the last NUMBER bytes, +NUMBER counts from start

-fFollow FILE(s) by descriptor, waiting for more data to be appended

-FFollow FILE(s) by filename, waiting for more data, and retrying

-s SECONDSUsed with -F, sleep SECONDS between retries (default 1)