Trevor Nugent SEC335 Living off the Land

Task One: LOLBin Identification and Documentation

Binary	Path	Purpose	Abuse	MITRE
cmd.exe	C:\Windows\System32\cmd.exe	CLI interpreter for commands and programs	Used to execute other utilities and discovery methods	T1059.003
certutil.exe	C:\Windows\System32\certutil.exe	Manage, configure, and troubleshoot certificates and keys	Can be abused to download and/or decode files	T1105
dnscmd.exe	C:\Windows\System32\dnscmd.exe	DNS server administration tools	Used to find used DNS zones and records	T1016
ldifde.exe	C:\Windows\System32\ldifde.exe	Manage directory objects in AD DS	Used to find AD structure	T1069.002
makecab.exe	C:\Windows\System32\makecab.exe	Compresses files to a .cab archive	Compressing files before exfiltration	T1560.001
net.exe	C:\Windows\System32\net.exe	Windows network, user, group, and service administration	Can be used to find users, groups, and services	T1087.001
netsh.exe	C:\Windows\System32\netsh.exe	Manage the Windows firewall and networking	Inspect networking/firewall configuration and create proxy connections	T1090
netstat.exe	C:\Windows\System32\netstat.exe	Display network connections and used ports	Used to identify active connections and associated processes	T1049
ntdsutil.exe	C:\Windows\System32\ntdsutil.exe	Variety of database administration tools, useful for data recovery	Can be used to steal AD database contents	T1003.003
tasklist.exe	C:\Windows\System32\tasklist.exe	Lists running processes	Used to discover a detailed list of all running processes	T1057
wevtutil.exe	C:\Windows\System32\wevtutil.exe	Manages and queries event logs	Can be used to query successful logons or clear logs among other things	T1654
wmic.exe	C:\Windows\System32\wbem\wmic.exe	Deprecated tool to run commands through the WMIC utility	Can be used for process creation and WMI queries	T1047

Which LOLBin appears in both advisories?: WMIC, ntdsutil, netsh, PowerShell, certutil, dnscmd, ldifde, makecab, net, nltest, systeminfo, tasklist, wevtutil, and xcopy

Why do state-sponsored actors prefer LOLBins over custom malware?: Malware is going to be quickly flagged in any competent system and likely won't run at all. These are built in tools that won't be flagged but can still achive much the same goal.

What is the "living off the land" naming convention based on?: It is because these tools are already present where they are working, there is no need to bring anything into the system.

Task Two:

Command: systeminfo
Screenshot: Revelation: This command provides essentially all the basic information you could want. It shows the exact version you are on, which attackers could use for version specific exploits. It shows your hostname and basic networking information. It even shows what hardware you are using, which could be used for hardware specific exploitations. This case even shows QEMU, which means it's a VM, and it shows that it only has about 4GB of RAM. If the attacker simply wanted to simply cause a disruption then they could use this information to slow the machine down to the point of a crash. MITRE: T1082

Command: ipconfig /all
Screenshot: Revelation: The addresses show where the machine sits on a network, along with the DNS and gateway it's pointing at. This information could be used both to attack the gateway itself, or to try to place yourself between the device and gateway such to attack the networking system.
MITRE: T1016

Command: net user
Screenshot: Revelation: This command shows all user accounts on a device. This shows the attacker potentially interesting account structure and would likely be used as a preliminary before running other more specific commands on the individual users to identify vulnerabilities. In this case, there aren't many accounts and they are largely defaults, so there likely aren't any immediately abuseable vulnerabilities. MITRE: T1087.001

Command: quser
Screenshot: Revelation: This command shows all users currently logged in. Primarily useful to determine if this machine has any other current users that might immediately notice whatever you might be doing to the machine. MITRE: T1033

Command: tasklist /v
Screenshot: Revelation: Tasklist shows all currently running processes and who owns them. Could be useful to see a list of possible anti virus or otherwise protective services and who owns them to allow you to shut them down.
MITRE: T1057

Command: netstat -ano
Screenshot: Revelation: Shows all active network connections, their state, the attached process, and with who/what ip they're communicating. Could be used to determine how deeply this device is being monitored, to figure out what devices are linked togeather in one way or another, or to use to execute a MITM attack.
MITRE: T1049

Command: netsh interface portproxy show all
Screenshot: Revelation: To my understanding, this command would typically show any ports that redirect to another. In this case, this machine has little on it and no reason to use this, so there aren't any. However, an attacker might be able to use this to find forwarded traffic where the host its directing to could be important or the traffic itself could be. Additionally, these ports might be less hardened than others on the system and it may be simpler to direct traffic through them.
MITRE: T1090

Command: wmic volume list brief
Screenshot: Revelation: Shows the various drives that my device has. In my case, it shows two seperate drives, the basic C drive as well as one with an ID of sorts marked as System Reserved that I imagine must be the OS itself? Regardless, this information could be used by attackers to help determine where important information might be stored. For example if a device has multiple drives and one is explicitly labeled for database use, then the attacker may specifically target that drive.
MITRE: T1082

Which binary revealed the most useful information for lateral movement?: If by lateral movement you mean within the network, then ipconfig /all was the definite winner. It showed all the IPs used in any contexts and what contexts. I imagine in a more established and active network netstat -ano might show more, but for one this simple ipconfig /all and a simple ping would likely be the most helpful.

Which binary's output would be most suspicious to a defender?: Of these, I think the wmin volume list would be the most immediately suspicious. It's an odd way to get your volumes for a typical user, and reveals information that could make it dramatically easier to find more hidden information and drives.

Why might a threat actor use wmic.exe instead of PowerShell for system queries?: WMIC is a built in tool with many of the queries that you would likely otherwise need a seperate powershell script for. Additionally, I believe WMIC produces less obvious logs than powershell otherwise would.

Task Three:

Command: certutil -decode C:\temp\encoded.txt C:\temp\decoded.txt
Screenshot: Explanation: Certutil is a legitimate utility that can be used to obfuscate files. In this case, I decode an encoded file and recover the origianl contents. This could be abused to manipulate bring in malicious files without them being detected as such, then decode them for use. Because Certutil is a normal utility, it's execution isn't likely to be flagged and monitored as closely as something might otherwise be.
MITRE: T1140

Command: expand test.cab output.txt Screenshot: Explanation: Expand is a legitimate Windows utility for extracting compressed files. An attacker could abuse it to extract a payload from an archive using a trusted system binary rather than a custom extraction program. Modern antivirus can open zips and cabs to detect malicious contents, but using a native Windows utility can reduce the number of new and suspicious files introduced onto the system and potentially blend the activity with more typical activies. MITRE: T1140

Command: wmic process call create "notepad.exe" Screenshot: Explanation: Wmic is a normal, though deprecated, tool. In this case, an attacker could easily use it to execute malicious code on the machine. Because it is a normal utility, it is likely to blend into typical system logs and whatnot more easily as well. MITRE: T1047

Command: net start spooler Screenshot: Explanation: Net start typically allows users to start services. However, like in the last lab, it could potentially be used to start replaced services or new ones with malicious code. Since this is an entirely typical command with standard and non suspisious logs, it isn't likely the system would immediately flag anything wrong, and a system administrator might overlook it as well. MITRE: T1007

COmmand: xcopy \localhost\c$\temp\test.txt C:\temp\xcopy-test.txt Screenshot: Explanation: Xcopy can, for whatever reason, copy files across the network. As such, an attacker with access to a device on the same network could use this to transfer files out or move them into for usage. As this is a built in binary, again, it is dramatically less likely to trigger any detection than a custom made script for the same use. MItRE: T1105

Command: certutil -urlcache -split -f https://example.com/ C:\temp\example.html Screenshot: Giving an 'Access is Denied' error for some reason whenever I use this command. Cannot determine why as I am using an admin window Explanation: Certutil, like xcopy, has odd usages that I don't quite understand. In this case, certutil can actually download full files off of websites. This could be used to grab a file off of a c2 for usage on this device.

Which LOLBin can download files without triggering typical firewall alerts?: Likely certutil. It's the most irregular way to download something, and I would imagine it might use a different request/reply header than many of the others since it's intended for certificates.

How can regsvr32.exe execute code without writing files to disk?: regsrv32 can be used to execute scriptlet contents off of a URL instead of something actually saved to disk, this removing the need to fully download a script as a file or write it up yourself.

Why is msbuild.exe dangerous in environments with .NET installed?: Because msbuild allows users to compile and run arbitrary C code without actually compiling it in a standard way such as via VSCode.

Task 4:

Command: systeminfo Screenshot:

Command: net user Screenshot:

Command: tasklist /v Screenshot:

Command: wmic process call create "notepad.exe" Screenshot:

Command: certutil -decode C:\temp\encoded.txt C:\temp\decoded.txt Screenshot:

Threat Report: https://github.com/tnugent371/tech-journal/wiki/Threat-Report

Which LOLBin would be hardest to detect with standard logging?: I think it'd likely be WMIC because I believe many things do typically use WMIC genuinely. As such simply looking through the logs for any usage of WMIC might end up with you simply overwhelmed with logs.

What is the trade-off between blocking LOLBin execution and breaking legitimate system functionality?: If you block many LOLBins then parts of the system may simply not function. These are genuinely useful tools that many built in apps and other functions may build on top of, and many users may use regularly. So if you outright block them entirely it makes the system as a whole at least a little less useable and useful.

How would you prioritize which LOLBins to monitor first?: I would prioritize by impact. The ones that can execute code, mainly regsvt32 where you don't even need to actually have a file for it, would be my highest priorties. Diagnostics on the system and discovery is important to block to a degree, but has little to no effect if they can very literally just run whatever code they please.