Vim GTFOBin Abuse for Command Execution
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Sigma
