Module 3

🌲Task 1: LOLBin Identification and Documentation🌲

⭐Objective⭐

Read both advisories and extract every LOLBin referenced. Update your Tech Journal mapping each binary to its legitimate purpose, abuse capability, and MITRE ATT&CK technique ID.

---

⭐Steps⭐

1. Open both advisories (ACSC and NSA/CISA PDF).
2. Scan for every Windows binary mentioned as abused by threat actors.
3. For each binary, record:
   • Binary name and full path (e.g., C:\Windows\System32\certutil.exe)
   • Its legitimate, intended function
   • How threat actors abuse it
   • The applicable MITRE ATT&CK technique and sub-technique ID (Search for the binary on the Mitre ATT&CK site)
4. Document at least 12 distinct LOLBins. Prioritize binaries that appear in both advisories.

🚀Task 1🚀

❓Questions to Answer❓

1. Which LOLBin appears in both advisories?
   • Most LOLBins appear in both advisories because they are government documented information.
2. Why do state-sponsored actors prefer LOLBins over custom malware?
   • They blend into a system more effectively than custom malware, making them difficult to detect.
3. What is the "living off the land" naming convention based on?
   • It is based off of pre-existing binaries in the Microsoft environment that can be exploited for malicious purposes on Windows systems.

🌲Task 2: Discovery and Reconnaissance LOLBin Execution🌲

⭐Objective⭐

Execute LOLBins used for system discovery and reconnaissance. Capture output and explain what each reveals to an attacker.

From the threat reports, select 8 LOLBins that are used for discovery and reconnaissance. The advisories reference binaries such as system information gatherers, network configuration tools, user enumeration utilities, process listing tools, domain trust explorers, and credential discovery commands.

⭐Steps/prep⭐

For each LOLBin you select:

1. Figure out the correct command and flags to run
2. Execute it on your Windows 10 VM
3. Capture the output (screenshot)
4. Explain what the output reveals to an attacker
5. Map it to a MITRE ATT&CK technique

🚀Task 2🚀

❓Questions to Answer❓

1. Which binary revealed the most useful information for lateral movement?
   • systeminfo revealed the most useful information for lateral movement because it gives the attacker all basic information about a victims system.
2. Which binary's output would be most suspicious to a defender?
   • whoami would be one of the most suspicious outputs for attackers because most personnel in a enterprise don't need to query their identity.
3. Why might a threat actor use wmic.exe instead of PowerShell for system queries?
   • A threat actor may use wmic.exe instead of PowerShell to evade detection and exploit built-in administrative tools already present on the system.

🌲Task 3: Execution, Download, and Defense Evasion LOLBin Execution🌲

⭐Objective⭐

Execute LOLBins used for file download, code execution, and defense evasion. Capture output and explain how each technique evades detection.

From the threat reports, select 6 LOLBins that are used for execution, download, or defense evasion. The advisories reference binaries used to download remote files, execute scripts without writing to disk, run code through legitimate system utilities, and bypass application allowlisting.

⭐Steps⭐

• For each LOLBin you select:
  1. Figure out the correct command and flags to run
  2. Execute a benign demonstration on your Windows 10 VM (create a C:\temp folder first, clean up after each test)
  3. Capture the output (screenshot)
  4. Explain why this technique evades detection
  5. Map it to a MITRE ATT&CK technique

🚀Task 3🚀

❓Questions to Answer❓

1. Which LOLBin can download files without triggering typical firewall alerts?
   • A couple different LOLBins have the capabilities to download files without triggering typical firewall alerts, including:
     • bitsadmin.exe
     • certutil.exe
     • ConfigSecurityPolicy.exe
2. How can regsvr32.exe execute code without writing files to disk?
   • Regsvr32.exe can execute code without writing files to disk by loading remote COM scriptlets via a URL passed directly on the command line.
3. Why is msbuild.exe dangerous in environments with .NET installed?
   • It can be used as a LOLBin to execute malicious code while bypassing application whitelisting and security defenses.

🌲Task 4: LOLBin Detection and Threat Report🌲

⭐Objective⭐

Build detection capabilities for LOLBin abuse and write a threat intelligence report based on your findings.

⭐Part A: Detection⭐

1. Download and install Sysmon. Use the Sysmon XML configuration file from SwiftOnSecurity as a default configuration for what to log.
2. Execute at least 5 of your LOLBins and show their execution in the Sysmon logs.

⭐Part B: Threat Report⭐

Write a structured threat intelligence report with these sections:

1. Executive Summary - What LOLBins are, why they matter, and which threat actors use them
2. LOLBIN Documentation - Your table from Task 1
3. Execution Evidence - Screenshots and command documentation from Tasks 2 and 3
4. Detection Recommendations - Event IDs, log sources, detection rules
5. Mitigation Recommendations - Application allowlisting, logging configuration, group policy settings

🚀Task 4🚀

❓Questions to Answer❓

1. Which LOLBin would be hardest to detect with standard logging?
   • LOLBins that are trickiest to detect are those that execute code or commands inside real, active, system processes.
2. What is the trade-off between blocking LOLBin execution and breaking legitimate system functionality?
   • The trade-off with blocking LOLBins is that you can either have a secure system and not worry about them, or have a system that is undisrupted by the lack of System LOLBins.
3. How would you prioritize which LOLBins to monitor first?
   • I would prioritize monitoring the LOLBins that give away basic information about my system such as systeminfo or whoami. Then I would monitor the ones mentioned earlier that execute code or commands inside real, active, system processes.