Linux Vim GTFOBin Abuse via Process Execution Flags and Shell Commands

title: Linux Vim GTFOBin Abuse via Process Execution Flags and Shell Commands
id: ea20d986-e27d-4619-a240-bba4c78d82ea
status: test
description: This rule flags Linux process creation where a Vim family binary (rvim, vi, vim, or vimdiff) is invoked with command-line options and Ex/command constructs that can execute shell or proxy commands. Such activity is commonly used to run unauthorized commands or escape restricted environments, so it is a high-signal indicator of command execution beyond normal text editing. It relies on telemetry from process creation events, focusing on the executable name and command-line substrings that indicate shell or scripting invocation.
references:
  - https://gtfobins.github.io/gtfobins/vi/
  - https://gtfobins.github.io/gtfobins/vim/
  - https://gtfobins.github.io/gtfobins/rvim/
  - https://gtfobins.github.io/gtfobins/vimdiff/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux, Huntrule Team
date: 2022-12-28
modified: 2026-06-05
tags:
  - attack.execution
  - attack.discovery
  - attack.t1059
  - attack.t1083
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - /rvim
      - /vi
      - /vim
      - /vimdiff
    CommandLine|contains:
      - " --cmd "
      - " -c"
  selection_cli:
    CommandLine|contains:
      - :!/
      - :!$
      - :!..
      - ":lua "
      - ":py "
      - :shell
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/csh
      - /bin/ksh
      - /bin/zsh
      - /bin/tmux
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
    type: derived