Full Report
Learn what LOLBins are, threats malicious threat actors can pose, how to detect those threats, and how to prevent them.
Analysis Summary
# Tool/Technique: Living Off the Land Binaries (LOLBins)
## Overview
Living Off the Land Binaries (LOLBins) are non-malicious, native operating system files (typically Windows or macOS) that are pre-installed as part of the OS. Threat actors exploit these trusted tools to execute malicious code, move laterally, and maintain persistence. The primary purpose is to "blend in" with legitimate administrative activity, bypassing traditional signature-based security tools that only look for known-bad files.
## Technical Details
- **Type**: Technique (leveraging legitimate tools)
- **Platform**: Windows, macOS, Linux
- **Capabilities**: Execution, Persistence, Privilege Escalation, Evasion, Lateral Movement, Data Exfiltration.
- **First Seen**: Though the concept is decades old, the formal term "Living Off the Land" gained prominence in the mid-2010s to describe fileless attacks.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1059.001 - PowerShell
- T1059.003 - Windows Command Shell
- **TA0005 - Defense Evasion**
- T1218 - System Binary Proxy Execution
- T1218.010 - Regsvr32
- T1218.011 - Rundll32
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
## Functionality
### Core Capabilities
- **Fileless Execution**: Executing malicious instructions directly in memory via tools like PowerShell or CMD without saving a malicious executable to the disk.
- **Trusted Proxy Execution**: Using signed binaries (e.g., `rundll32.exe`, `regsvr32.exe`) to run malicious DLLs or scripts, effectively masking the source of the execution.
- **Administrative Tasks**: Using `net.exe` for account creation or `schtasks.exe` for persistence via scheduled tasks.
### Advanced Features
- **Obfuscation**: Using non-standard command syntax to bypass simple pattern-matching detections (e.g., changing the order of flags in `net /add user`).
- **Data Exfiltration**: Leveraging tools like `bitsadmin.exe` or `certutil.exe` to download or upload malicious payloads and exfiltrate data.
## Indicators of Compromise
- **File Names**: Legitimate system files used in unusual contexts:
- `powershell.exe`
- `cmd.exe`
- `net.exe` / `net1.exe`
- `rundll32.exe`
- `regsvr32.exe`
- `certutil.exe`
- **Registry Keys**: Look for modifications in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` or `HKLM` equivalents performed by LOLBins.
- **Behavioral Indicators**:
- **Typosquatting in Commands**: Creation of accounts with names like `Adminstrator` (missing "i") or `sqladmin`.
- **Suspicious Passwords**: Repeated use of common actor-chosen passwords such as `Ujmqaz5055`, `P@ssw0rd01!`, `Nullpass123`, `JapanNight!128`, and `Noface66Nocase!`.
- **Non-standard syntax**: Deviating from typical administrative CLI patterns (e.g., `net /add user [username] [password]`).
## Associated Threat Actors
- While almost all modern APTs and ransomware groups use LOLBins, they are quintessential to:
- **Fileless Malware Campaigns**
- **Advanced Persistent Threats (APTs)** seeking long-term stealth.
- **Ransomware Operators** for lateral movement and credential harvesting.
## Detection Methods
- **Behavioral Detection**: Monitoring for "living off the land" patterns that deviate from a baseline (e.g., a standard user running `net.exe` or `certutil.exe` downloading a file).
- **Command Line Logging**: Enabling Windows Event ID 4688 (Process Creation) with Command Line Auditing and PowerShell Script Block Logging (Event ID 4104).
- **Contextual Analysis**: Evaluating the *who, when, and where*—investigating why a web server process is spawning a command shell.
## Mitigation Strategies
- **Attack Surface Reduction (ASR)**: Implement rules to block process creations from Office applications or unauthorized scripts.
- **Least Privilege**: Ensure standard users do not have permissions to run powerful administrative tools like `powershell.exe` or `cmd.exe` if not required for their role.
- **Application Whitelisting/Control**: Use AppLocker or Windows Defender Application Control (WDAC) to restrict which binaries can be executed and by whom.
- **Hardening**: Disable or restrict unnecessary built-in tools that are frequently abused.
## Related Tools/Techniques
- **LOLBAS**: Living Off The Land Binaries and Scripts (a project cataloging these tools).
- **Fileless Malware**: Malware that exists only in RAM and uses LOLBins for execution.
- **Bring Your Own Vulnerable Driver (BYOVD)**: A related concept where attackers bring legitimate but vulnerable drivers to bypass kernel protections.