bash

Linux execution T1059.004

GNU Bourne Again Shell. Executing bash with -i or -c allows spawning interactive shells or running commands, commonly used in reverse shells.

Binary Paths

  • /bin/bash
  • /usr/bin/bash

Glob Patterns

Pattern Wildcards Notes
bas?
? Wildcard replaces 'h'
b*h
* Star matches 'as'
ba[s]h
[] Character class around 's'
b?sh
? Wildcard replaces 'a'
b?s?
? Two wildcards
/bin/bas?
? Full path wildcard on last char
/???/bash
? Obfuscate /bin/ prefix
/b?n/b*h
? * Mixed wildcards across path and command
b[a]sh
[] Bracket class on second char
/???/b*
? * Highly obfuscated full path (may match other binaries)

Resources

← Back to Catalog