Full Report
Rhetoric within the cybersecurity community has leaned heavily towards threat actor use of LOLBins as a means of “hiding amongst the noise” of normal, administrative and operational activity. However, as Huntress SOC analysts can attest, this is often far from the case.
Analysis Summary
# Tool/Technique: LOLBins (Living Off the Land Binaries)
## Overview
LOLBins (Living Off the Land Binaries) are legitimate, pre-installed operating system binaries—primarily within Windows—that are used by threat actors to perform malicious actions. The purpose of using LOLBins is to bypass security controls and "hide in plain sight" by leveraging trusted system utilities that are already present and often whitelisted by security software.
## Technical Details
- **Type:** Technique / Tool (Trusted System Binaries)
- **Platform:** Windows (primarily), though the concept applies to Linux/macOS.
- **Capabilities:** Execution, data transfer, persistence, defense evasion, and reconnaissance.
- **First Seen:** Historically used for decades; formalized as "LOLBAS" (Living Off the Land Binaries and Scripts) in late 2017/2018.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1204 - User Execution
- **TA0005 - Defense Evasion**
- T1218 - System Binary Proxy Execution
- T1218.001 - MsiExec
- T1218.005 - Mshta
- T1218.011 - Rundll32
- **TA0011 - Command and Control**
- T1105 - Ingress Tool Transfer
## Functionality
### Core Capabilities
- **Legitimate Proxy Execution:** Using signed binaries to run malicious code, reducing the likelihood of detection by signature-based AV.
- **File Download/Upload:** Using utilities like `certutil.exe` or `curl.exe` to fetch payloads or exfiltrate data.
- **System Reconnaissance:** Leveraging `finger.exe`, `whoami.exe`, or `net.exe` to gather information about the environment.
### Advanced Features
- **Fileless Execution:** Running code directly in memory without writing new malicious files to the disk.
- **Bypassing AppLocker/WDAC:** Using trusted binaries (like `mshta.exe` or `installutil.exe`) that are often exempted from application control policies to execute unauthorized code.
## Indicators of Compromise
- **File Names:** `certutil.exe`, `curl.exe`, `finger.exe`, `mshta.exe`, `rundll32.exe`, `powershell.exe`, `cmd.exe`.
- **Behavioral Indicators:**
- **Unexpected Parent Processes:** e.g., `sqlservr.exe` spawning `cmd.exe` or `winword.exe` spawning `powershell.exe`.
- **Non-standard Directories:** System binaries executed from `%TEMP%` or user profile folders instead of `C:\Windows\System32`.
- **Suspicious Command-line Flags:** e.g., `certutil -urlcache -split -f` used to download files.
- **Anomalous Network Connections:** A system utility (like `certutil`) making an external connection to an unfamiliar IP or domain.
## Associated Threat Actors
LOLBins are used by a vast majority of threat actors, ranging from opportunistic script kiddies to advanced persistent threats (APTs) such as:
- **APT28 (Fancy Bear)**
- **Lazarus Group**
- **FIN7**
- **RedCurl**
## Detection Methods
- **Behavioral Detection:** Monitoring for anomalous process relationships (Parent-Child) and unusual command-line arguments.
- **Baselining:** Establishing a "normal" usage pattern for administrative tools and alerting on deviations.
- **EDR/Managed EDR:** Utilizing endpoint detection and response tools to track the execution chain and network telemetry of signed binaries.
- **Logging:** Enabling and monitoring Windows Event Logs (specifically Event ID 4688 with command-line auditing).
## Mitigation Strategies
- **Attack Surface Reduction (ASR):** Implement ASR rules to block common LOLBin abuse patterns (e.g., blocking Office applications from creating child processes).
- **Application Control:** Use Windows Defender Application Control (WDAC) or AppLocker to restrict the execution of specific binaries to authorized users/scripts only.
- **Hardening:** Disable or remove unnecessary optional features/binaries (e.g., `finger.exe`) if they are not required for business operations.
- **Least Privilege:** Ensure users do not have administrative rights that would allow them to abuse high-privilege system tools.
## Related Tools/Techniques
- **LOLBAS Project:** A community-driven list of Windows binaries, scripts, and libraries that can be used for "living off the land."
- **Fileless Malware:** Malware that exists only in RAM and uses system tools to maintain presence.
- **Living Off the Land Scripts (LOLS):** Abuse of script interpreters like `vssadmin.vbs` or `slmgr.vbs`.