Living Off the Land

• Living off the Land binaries are real Windows executables that threat actors use to carry attacks. Because these binaries ship with Windows and are signed by Microsoft, they blend in with normal system activity and often bypass application allow listing rules and antivirus detection.

State-sponsored threat groups, including Volt Typhoon (PRC-linked), have used LOLBin techniques to compromise and maintain persistent access to US critical infrastructure networks. The Australians Cyber Security Centre 9ACSC) and the National Security Agency (NSA) jointly published advisories documenting these techniques.

Lab Environment Setup

Use Windows 10 VM. Need standard user and admin access. No special software installation is required. All LOLBins used within assignment are native Windows binares.

Task 1: LOLBin Identification and Documentation

Binary (Path)	Legitimate Purpose	Abuse Method	MITRE ATT&CK ID	Advisory Reference
wmic.exeC:\Windows\System32\wbem\wmic.exe	CLI front end for WMI; queries/manages local or remote system config, hardware, processes	Remotely creates processes (e.g., launching ntdsutil); enumerates disks, volumes, services, installed products	T1047 (Windows Management Instrumentation)	Both advisories list wmic among LOTL binaries used for discovery and remote command execution; 2024 advisory notes WMIC drove ntdsutil for NTDS.dit extraction
ntdsutil.exeC:\Windows\System32\ntdsutil.exe	Built-in AD maintenance tool for managing the AD database, snapshots, DC roles	Invoked (often via wmic) with the ifm option against a Volume Shadow Copy to extract ntds.dit + SYSTEM hive for offline cracking	T1003.003 (OS Credential Dumping: NTDS)	Both advisories describe ntdsutil as the utility used to copy ntds.dit from a shadow copy; both give long/short-form command syntax
vssadmin.exeC:\Windows\System32\vssadmin.exe	Native tool for creating/listing/managing Volume Shadow Copies	Creates a shadow copy of the OS volume so the locked ntds.dit file can be copied out while the DC stays live	T1006 (Direct Volume Access)	2024 advisory explicitly names vssadmin; 2023 advisory shows the equivalent vssadmin create shadow command
netsh.exeC:\Windows\System32\netsh.exe	Native network shell for interfaces, firewall rules, routing/proxy settings	interface portproxy creates host:port forwarding, turning a host/intermediary server into a covert C2 relay	T1090.001 (Proxy: Internal Proxy) / T1112 (Modify Registry)	Both advisories detail netsh portproxy commands and the resulting HKLM\SYSTEM\...\PortProxy registry key
PowerShell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Built-in scripting/automation shell for administering Windows	Queries event logs (Event ID 4624), exports results for offline analysis, launches FRP proxy clients for covert C2	T1059.001 (Command and Scripting Interpreter: PowerShell)	Both advisories show Get-EventLog-based one-liners; 2024 advisory adds FRP clients launched via PowerShell
certutil.exeC:\Windows\System32\certutil.exe	Native certificate services utility for managing/verifying/encoding certs	Listed among native discovery/utility binaries used during intrusion; commonly abused for base64 encode/decode and file transfer	T1105 (Ingress Tool Transfer) / T1027 (Obfuscated Files or Information)	Appears in the discovery tool list in both the 2023 TTP summary and 2024 LOTL discovery table
reg.exeC:\Windows\System32\reg.exe	Native registry CLI for querying, saving, modifying the registry	reg query hunts for stored creds (PuTTY, RealVNC, OpenSSH); reg save exports SAM/SYSTEM hives	T1012 (Query Registry) / T1003.002 (OS Credential Dumping: SAM)	Both advisories list reg query/save commands; 2023 advisory gives specific PuTTY/RealVNC/OpenSSH examples
systeminfo.exeC:\Windows\System32\systeminfo.exe	Native utility showing detailed OS/computer configuration	Baseline host reconnaissance (OS version, patch level, hardware) early in an intrusion	T1082 (System Information Discovery)	Appears in the discovery command lists of both the 2023 and 2024 advisories
tasklist.exeC:\Windows\System32\tasklist.exe	Native utility listing currently running processes	/v flag enumerates detailed process info to identify security tooling and follow-on targets	T1057 (Process Discovery)	Both advisories list tasklist; 2024 advisory shows a specific tasklist /v entry from PowerShell console history
wevtutil.exeC:\Windows\System32\wevtutil.exe	Native CLI for querying, exporting, clearing Windows Event Logs	Queries specific Security log events (e.g., Event ID 4624) with structured XPath filters	T1654 (Log Enumeration) / related T1070.001 (Indicator Removal: Clear Windows Event Logs)	Both advisories include a wevtutil qe security command with an XPath filter on EventID 4624
net.exeC:\Windows\System32\net.exe	Native utility for managing users, groups, shares, connections	Enumerates local/domain accounts, privileged groups (e.g., Domain Admins), running services, network shares	T1087.001 (Account Discovery: Local Account) / T1069 (Permission Groups Discovery)	Both advisories list net user/group/use; 2023 advisory specifically shows net group "Domain Admins" /dom
ldifde.exeC:\Windows\System32\ldifde.exe	Native LDAP Data Interchange utility for importing/exporting AD objects	Exports AD directory data (subtree) to a text file for offline review	T1087.002 (Account Discovery: Domain Account) / T1069.002 (Permission Groups Discovery: Domain Groups)	Both advisories list an ldifde.exe -f ... -p subtree command
makecab.exeC:\Windows\System32\makecab.exe	Native Cabinet (.cab) compression utility, normally for driver/update packaging	Compresses staged files (e.g., exfiltrated registry hives) into a single archive before moving/exfiltrating	T1560.001 (Archive Collected Data: Archive via Utility)	Both advisories list makecab among the LOTL tools, grouped with archiving/exfil-staging activity
xcopy.exeC:\Windows\System32\xcopy.exe	Native utility for copying files/directory trees, including over UNC paths	Moves staged or exfiltration-ready files between directories/public/temp folders	T1074 (Data Staged) — commonly paired with T1560	Both advisories list xcopy; 2023 advisory shows xcopy C:\windows\temp\hp d:\{REDACTED}
comsvcs.dll (via rundll32.exe)C:\Windows\System32\comsvcs.dll	Legit COM Services DLL; exported MiniDump function intended for diagnostic process memory dumps	Outdated copy placed in a non-standard folder, invoked with the LSASS process ID to dump LSASS memory	T1003.001 (OS Credential Dumping: LSASS Memory)	2024 advisory describes actors downloading an outdated comsvcs.dll to a non-standard folder and using it with MiniDump against the LSASS PID

1. Which LOLBin appears in both advisories?

Almost every binary were in both advisories. The 2024 Volt Typhoon advisory builds on cross references the 2023 advisory's. The most heavily documented overlap is the nrdsutil.exe Both of the advisories had documented the same technique of using a "Void Shadow Copy" and then invoking ntdsutil to extract the AD Database, and also the system registry for password cracking. Some other binaries documente d in both is with Powershell, netsh, systeminfo and more.

2. Why do state sponsored actors prefer5 LOLBinss over custome malware?

One reason is reduced logging footprints, which many organizations do not enable enhanced logging like command line, and Powershell logging. So LOTL activity might not be recorded, while custom malware often leaves artifacts. Another reason is that its easier to blend in because LOLBins are pre=installed, making it another reason harder to detect.

3. What is the living off the land naming convention based on>

The term is from the phrase "living off the land", meaning to only using resources available immediately to a person. In cybersecurity context, it means that attackers can use the resources available to them within an OS instead of using custom malware.

Discovery & Reconnaissance LOLBin execution

systeminfo

Command: systeminfo

This reveals to an attacker the hosts configuration information, and security vulnerabilities a hacker can use. They could map the system out with this information, an attacker can mapo out the system and articulate an attack that'd be perfect for this build and OS.

command: tasklist/v

This reveals to a hacker real time visibility to every process running. It can see what the security software is, like windows defender.

command:whoami

This shows to an attacker their permissions and identity on a machine. It reveals the domain and the compuiter name, and username, which can allow the hacker to figure out their target

command: netstat -ano

This reveals every active network connections, listening ports, and the PID on the machine. It tells them who the machine is able to talk to, what services are exposdsed to the outwowlr world and potentially how to move deeper into the network.

command: ping -n 1

This can test for host availability and test network connectivity while keeping the footprint as small as they can, a normal ping can be flagged- but you only use 1 packet in this command. It could verify and ping 8.8.8.8.

command: net group "Domain Admins" /dom

This reveals every user account that can hold admin privilege's within a network. Attackers can create a hitlist with this in mind.

command: ipconfig/all

This shows all the information regarding a computers network, and can find neighboring machines through this and ping any neighbors.

Questions

Which binary revealed the most useful information for lateral movement?

I think that netstat can have the most use here, providing the most useful information to know hat active connections the machine has. Its able to go deeper into the network that way.

Which binary's output would be most suspicious to a defender?

To me the most suspicious would be the net group, because I dont know a real reason an everyday person would be checking who has administrative permissions if they work there.

Why might a threat actor use wmic.exe instead of PowerShell for system queries?

Powershell relies on Script Block Logging, meaning everything can get flagged in Event Logs. wmic.exe does not feed into the script block logs, which allows attackers to go under the radar on a regular basis.

regsvr32.exe

System Binary Execution

My Script

The output reveals several things to an attacker, mainly the timestamp. It can tell the attacker the local time zone the victim is it. This can be used to blend in within the companies or organizations regular business hours.

LOLBin mshta.exe

MITRE ATT&CJ ID:T128.005 Mshta

This LOLBin reveals to an attacker also the victims machines local time and date, similarly regsvr32.exe . mshta.exe is a build in Windows binary thats made to run .hta files. One big reason it evades detection is because it is executing in memory. The script inside the file runs inside the mshta process, and the payload is inside an HTML file.

rundll32.exe

This is a simple one, it opens the calculator. However for an attacker, it shows that rundl can successfully load a system DLL and use it to spawn an arbitrary process. In a real attack, the calc.exe would be switched for a malicious payload.

certutil.exe - Obuscated Files or information

MITRE ATT&CK ID: T1207

Ran in cmd instead of PowerShell due to "Access being denied.

This output reveals to an attacker that certutil is useable and functional. It encodes payloads before transfer, and deocoding them after. The wrapper (BEGIN CERTIFICATE) can mean that the malware is encoded to a real certificate, and bypass inspection that would flag it regularly.

It evades detection because the outbound HTTP requests looks like normal, regular routine cert checking. It looks normal to the average person and wouldnt be flagged.

bitsadmin.exe

Command

Output

This output reveals to an attacker that the BITS (Background Intelligent Transfer Service) service is active, and the outbound HTTP is reachable. Mainly also, that the files can be pulled from external servers through the service. They are able to confidently now use this to stage payloads from a remote server using the service.

It evades detection because the traffic is indistinguishable from the regular update downloads, and firewalls usually allowlist it.

MIRTE ATT&CK ID: T1197

PowerShell.exe

This shows to an attacker a list of every process running by name, PID and also CPUI usage. It shows things like MsMpEng which shows them that Defender is running. This can help pick out targets for browser credentials.

It evades detect as PowerShell is again, a Microsoft tool that runs normally everyday. The Get-Process output can look exactly the same as a regular sysadmin script.

MITRE ATT&CK ID: T1059.001

Task 3 questions

1. bitsadmin.exe , as it handers transfers to the Windows Background Intelligent Transfer Service. It is the same service Windows Updates uses, making it unable to differentiate from regular traffic.

2. Using .u .i<oatg< scrobj.dll , regsvr32 executes a .sct which allows to extract and embded the Script in memory

3. CodeTaskFactory lets attackers embed C# inside an XML file and compile it into memory at runtime. It gives the full .NET Framework without binary touched it.

Task 4

Task A

My execution of the logs created with Sysmon

Task B: Executive Summary

Regarding detection, I would focus more on behavioral context than only the file signature. As a system administrator, you should know and memorize even the important normal routines, who is able to administrative tools, and from which endpoints. Look for misuse of services like cerutil to download weird unknown files instead of what it was made for, managing certificates. The biggest defense someone can make against using Endpoint Detection and Response platform, which is setup for in memory detection.

The best way to mitigate LOLBins use is to restrict privilege's and give only enough privilege's to those that need it. This builds a a solid foundation to prevent any damage an attacker is able to do if they can use tools under a compromised account, and go by undetected nonetheless.