CmdID / Programs / Linux and Unix
tee
Read from stdin and write to stdout and files (or commands). tldr-pages
GTFOBins file-write 1 documented command
How tee is abused
file-write
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for tee.
1 documented command
file-write unprivileged, with sudo, as SUID
Use -a to append data to exising files.
echo DATA | tee /path/to/output-fileThe command CmdID reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for tee. CmdID reads the line that runs tee.
Everyday use
Copy stdin to each file, and also to stdout
echo "example" | tee path/to/fileIdentifyAppend to the given files, do not overwrite
echo "example" | tee --append path/to/fileIdentifyPrint stdin to the terminal, and also pipe it into another program for further processing
echo "example" | tee /dev/tty | xargs printf "[%s]"IdentifyNone of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of tee
-aAppend to files-iIgnore SIGINT