Living Off the Land Binaries ‐‐ Execution and Documentation - aljimenez28/SEC-335 GitHub Wiki
Task 1: LOLBin Identification and Documentation
| Binary | Legitimate Purpose | Abuse Method | MITRE ATT&CK ID |
|---|---|---|---|
| certutil.exe | Manages digital certificates on Windows | Named in both advisories as a core LOTL tool used for discovery and lateral movement | T1218.011 |
| systeminfo.exe | Displays OS, hardware, and patch summary | ACSC/NSA list it as a standard recon tool actors run to profile a compromised host | T1082 |
| tasklist.exe | Lists running processes and their PIDs | NSA/CISA describe the actor running tasklist /v to get a detailed process listing |
T1057 |
| net.exe | Manages users, groups, and network shares | NSA/CISA show the actor running net localgroup administrators and net group "Domain Admins" /dom to map privileged accounts |
T1087.001 |
| quser.exe | Shows currently logged-on user sessions | ACSC lists it alongside net user for enumerating active sessions on a host | T1087.001 |
| vssadmin.exe | Creates and manages volume shadow copies | NSA/CISA show the actor creating a shadow copy specifically to bypass the file lock on ntds.dit | T1006 |
| wmic.exe | Runs WMI queries from the command line | NSA/CISA detail wmic being chained with ntdsutil to remotely trigger the NTDS.dit copy process | T1047 |
| netsh.exe | Configures network interfaces and the firewall | NSA/CISA show it used to add PortProxy entries that redirect traffic and tunnel past firewall rules | T1090.001 |
| PowerShell.exe | Scripting and system administration shell | NSA/CISA cite the actor running Get-EventLog security -instanceid 4624 to pull successful logon history |
T1059.001 |
| reg.exe | Reads and writes the Windows registry | NSA/CISA show reg query used to hunt for stored credentials (PuTTY, VNC) and reg save used to dump SAM/SYSTEM hives | T1012 / T1003.002 |
| wevtutil.exe | Queries and exports Windows event logs | NSA/CISA show it filtering security logs for a specific event ID and time window | T1654 |
| xcopy.exe | Copies files and directory structures | NSA/CISA show it moving staged files (xcopy C:\windows\temp\hp d:\...) as part of exfiltration prep |
T1074 |
Questions:
- Which LOLBin appears in both advisories?
certutil, dnscmd, ldifde, makecab, net (user/group/use), netsh, xcopy, and many more
- Why do state-sponsored actors prefer LOLBins over custom malware?
For a few reasons such as that they blend in with admin activity. Since the binaries are signed, native Windows tools that IT admins use every day (wmic, netsh, or PowerShell) doesn't automatically look suspicious. On that note, long term stealth matters more to these actors than speed.
- What is the "living off the land" naming convention based on?
It is when an attacker uses legitimate, preinstalled tools and software on the target system to carry out malicious activities instead of bringing in custom malware.
Task 2: Discovery and Reconnaissanse LOLBin Execution
Command for T1082:
systeminfo
Screenshot:
What the Output Reveals to an Attacker:
- Hostname: displays the computer's name on the network which attackers can use to identify a machine in logs and future connections
- OS Name, Version, Build, & Configuration: This tells an attacker exactly which vulnerabilities to exploit.
- System Boot Time: This shows the uptime of a machine. If a machine has been up too long without a reboot, there may be some missing patches.
- System Manufacturer/Model: Ours is a QEMU, Standard PC (i440FX) which is a VM. This is essential for attackers because if they knew they were trying to exploit a VM compared to a real machine they would behave differently or abandon the project all together.
- Hotfix: Attackers can cross reference the KB numbers against what isn't installed to figure out which CVE's are still exploitable on the host.
Command for T1057:
tasklist /v
Screenshot:
What the Output Reveals to an Attacker:
The output shows the Process ID (PID) for particular executables and attackers can use this to target a specific process. In this screenshot, lsass.exe stands out because its the Security Authority Subsystem Service. That's the process that holds credentials in memory. Knowing the exact PID would let them target it directly and exploit it instead of searching for it.
Command for T1087.001:
net user
net localgroup administrators
Screenshot:
What the Output Reveals to an Attacker:
net user lists every local user account on the machine. In our case, we have administrator, champuser, DefaultAccount, Guest, and WDAGUtilityAccount. An attacker would use this to see which users exist on the machine before deciding which ones to target.
net localgroup administrators lists the members of the local administrators group specifically. This tells the attacker which accounts have full admin access so if they infiltrate champuser (in our case), they get complete control without needing to escalate privileges.
Command for T1087.001:
quser
Screenshot:
What the Output Reveals to an Attacker:
This reveals the user that is currently logged onto the machine, the type of session they had, how long they've been on. Under SESSIONNAME, we have console meaning this is a local interactive session and not remote. The active state indicates that the machine is not idle or disconnected. An attacker could utilize this by giving them the real target instead of possibilities.
Command for T1047:
wmic process get name,processid
Screenshot:
What the Output Reveals to an Attacker:
This queries Windows Management Instrumentation (WMI) for a list of every running process. We included get name,processid so there are only the following two columns: the name and it's PID. This would be the first step before a second and more targeted wmic command.
Command for T1012:
reg query "hklm\software\microsoft\windows nt\currentversion"
Screenshot:
What the Output Reveals to an Attacker:
This is mostly the same information we recieve from systeminfo, but it is pulled directly from the registry instead of a formatted summary tool.
Command for T1059:
Get-EventLog -LogName Application -Newest 5
Screenshot:
What the Output Reveals to an Attacker:
The output shows the Index (internal record number), Time (timestamp of event), EntryType (severity level), Source (which application it was from), InstanceID (specific event code), and a message. If an attacker was on my VM and saw the repeated errors from vmStatsProvider and vmGuestLibrary, they would know that they were on a virtual machine.
Command for T1654:
wevtutil
Screenshot:
What the Output Reveals to an Attacker:
This output is a more detailed version of our Get-EventLog showed earlier but wevtutil gives the entire raw structure of each event instead of the summary. Beyond confirming that this machine is a VM, these results give us a more specific fingerprint and suggests that the VM image may have been cloned or built from a template instead of the original version on VMware. This is something that an attacker would note because VM templates sometimes carry over leftover settings or credentials from their original environment.
Questions:
- Which binary revealed the most useful information for lateral movement?
I believe net localgroup administrators reveals the most useful information. If an attacker already knows which accounts have admin access, they will target those and wouldn't need to escalate privileges.
- Which binary's output would be the most suspicious to a defender?
Get-EventLog security -instanceid 4624 and wevtutil qe security would stand out the most since a normal user would not target a security log.
- Why might a threat actor use wmic.exe instead of Powershell for system queries?
There would be less logging visibility, it wmic.exe bypasses the Antimalware Scan Interface (AMSI) that hooks directly into Powershell, there's lower monitoring priority, and it is generally simpler for more specific tasks.
Part 3: Execution, Download, and Defense Evasion LOLBin Execution
Command for T1218.011:
certutil -encode C:\temp\test.txt C:\temp\test_encoded.txt
Screenshot:
Why this technique evades detection:
This technique evades detection because it's signed, trusted, allowlisted binary performing its intended function. The malicious part isn't the tool itself but how the output is being used afterward.
Command for T1560.001:
makecab C:\temp\test.txt C:\temp\test.cab
Screenshot:
Why this technique evades detection:
makecab.exe is a signed Windows utility whose purpose is to compress files. There is no reason for a security tool to flag normal compression activity.
Command for T1047:
wmic process call create "cmd.exe /c echo test > C:\temp\wmictest.txt"
Screenshot:
Why this technique evades detection:
wmic.exe is built into Windows and is used constantly by legitimate sysadmins for remote management and scripting. It also generates way less logging detail than Powershell so its command chains leave a thinner forensic trail.