T1005: Technique T1005

Base64 encodes or decodes standard input or files to standard output. Attackers abuse it to read sensitive files without user permissions (when SUID) or decode obfuscated payload stages.

Dd converts and copies raw files and disks. Attackers abuse SUID dd to read raw partitions, memory dumps, or extract protected shadow files.

Head outputs the beginning of files. SUID head allows unauthorized users to read the initial lines of protected files like /etc/shadow or root SSH private keys.

Tail outputs the last part of files. SUID tail allows standard users to read protected credentials, tokens, and audit log entries.

Nl numbers lines from files. SUID nl enables unauthorized reading of sensitive files.

Grep searches for patterns in text files. When given SUID permissions, grep can extract passwords, hashes, and tokens from restricted files.

Sed is a stream editor for filtering and transforming text. SUID sed allows reading sensitive files or modifying configuration entries.

Date displays or sets system date and time. SUID date can be abused with the -f parameter to read files line-by-line via error messages.

Sqlite3 queries SQLite databases. Attackers use it to query Chrome and Safari cookies, browsing history, and notes databases without launching browsers.

Log queries the macOS Unified Logging System. Attackers interrogate system logs to find sensitive tokens, user activities, or cleartext credentials.