Week 3 Lab - wetzel7/SEC-335 GitHub Wiki

Living Off the Land Binaries (LOLBins) - Execution and Documentation

Task 1 - LOLBin Identification and Documentation

Objective: Read both advisories and extract every LOLBin referenced. Update your Tech Journal mapping each binary to its legitimate purpose, abuse capability, and MITRE ATT&CK technique ID.

#	Binary	Full Path	Legitimate Purpose	Abuse Method	MITRE ATT&CK
1	wmic.exe	`C:\Windows\System32\wbem\wmic.exe`	Command line interface for Windows Management Instrumentation. It queries and manages local/remote systems	Used to collect system information and execute processes, and it can launch other LOLBins (e.g., ntdsutil.exe) to copy Active Directory data	T1047
2	ntdsutil.exe	`C:\Windows\System32\ntdsutil.exe`	Administrative utility tool for managing/maintaining Active Directory Domain Services	Can be used to create copies of the NTDS.dit database and registry hives, which can expose domain password hashes	T1003.003
3	powershell.exe	`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`	Scripting and automation shell for administration/configuration	Used to query Security Event Log entries (e.g., Event ID 4624) to identify successful logons, users, and authentication activity	T1059.001
4	netsh.exe	`C:\Windows\System32\netsh.exe`	Displays/modifies network, interface, and firewall settings	PortProxy rules used to forward network traffic through compromised systems	T1090
5	vssadmin.exe	`C:\Windows\System32\vssadmin.exe`	Manages Volume Shadow Copies for backup/recovery	Volume Shadow Copy functionality used to access locked files such as NTDS.dit	T1006
6	cmd.exe	`C:\Windows\System32\cmd.exe`	Standard Windows command line interpreter	Used to run discovery commands, launch other LOLBins, perform file operations, and redirect output	T1059.003
7	systeminfo.exe	`C:\Windows\System32\systeminfo.exe`	Displays OS and hardware configuration details	Used to collect OS details and system configuration	T1082
8	tasklist.exe	`C:\Windows\System32\tasklist.exe`	Displays currently running processes	Used (e.g., `tasklist /v`) to identify running applications, processes, and process details	T1057
9	net.exe	`C:\Windows\System32\net.exe`	Manages users, groups, services, shares, and network resources	Commands like `net localgroup administrators` or `net group "Domain Admins" /dom` identify privileged users/groups	T1069.001 / T1069.002
10	whoami.exe	`C:\Windows\System32\whoami.exe`	Displays the username and security context of the current account	Used to identify the operating account and determine group memberships/privileges	T1033
11	ipconfig.exe	`C:\Windows\System32\ipconfig.exe`	Displays TCP/IP configuration (IP, gateway, DNS, interfaces)	`ipconfig /all` used to gather network configuration and map the victim environment	T1016
12	ping.exe	`C:\Windows\System32\ping.exe`	Tests network connectivity via ICMP echo requests	Used to determine whether remote systems/IPs are reachable	T1016.001
13	certutil.exe	`C:\Windows\System32\certutil.exe`	Certificate-services utility; can also encode/decode files	Documented as a living-off-the-land tool in both advisories; can decode previously encoded text using a trusted Windows binary	T1140

Task 1 - Questions

Which LOLBin appears in both advisories?

More than one, at least 10 overlap in advisory databases including certutil, wevtutil, WMIC, xcopy, net, netsh, nltest, ntdsutil, PowerShell, and makecab.

Why do state-sponsored actors prefer LOLBins over custom malware?

An already installed/trusted program ready for use/abuse on a machine is much more efficient than getting custom proprietary malware onto a box and ready for exploiting. LOLBins on windows systems are often already trusted programs as well so there's no need to install any other malicious program, which reduces a risk of getting caught as it blends into regular windows activity.

What is the "living off the land" naming convention based on?

The term refers to attackers utilizing legitimate tools that are preexisting on compromised environments and repurposing them for malicious activity rather than loading up and bringing their own malware tools.

Task 2 - Discovery and Reconnaissance

Objective: Execute LOLBins used for system discovery and reconnaissance. Capture output and explain what each reveals to an attacker.

Task 2 - Discovery and Reconnaissance

1. systeminfo.exe

Run:

systeminfo

An attacker could use this information to check which vulnerabilities might be available for exploitation

MITRE ATT&CK: T1082

2. ipconfig.exe

Run:

ipconfig /all

Attackers could use information in this screenshot to identify network infrastructure and configuration, as well as localized subnets and nearby systems

MITRE ATT&CK: T1016

3. whoami.exe

Run:

whoami /all

This command outputs user SIDs, group memberships, and privileges, which all can be abused to determine whether the active account they're in has elevated rights.

MITRE ATT&CK: T1033

4. tasklist.exe

Run:

tasklist /v

Listing processes like this could give an attacker the ability to identify security software, admin programs, active applications and other useful processes. The output could be several screens long, giving them a lot of programs to choose from

MITRE ATT&CK: T1057

5. netstat.exe

Run:

netstat -ano

The output of this command displays TCP connections, UDP endpoints, local and remote addresses plus connection states, and process IDs

A connection in the screenshot is listed as an ESTABLISHED state with PID 2496 is a process associated with that connection. An attacker could use this information to ID listening services, active communications and processes that may be useful for recon or lateral movement

MITRE ATT&CK: T1016

6. net.exe

Run:

net localgroup administrators

The lab vm shsows two users of the local admin group, champuser and administrator. The output also states members of the admin group have complete and unrestricted access to the computer and domain, and an attacker could use this command to ID privileged accounts.

MITRE ATT&CK: T1069.001

7. wmic.exe

Run:

wmic path win32_logicaldisk get caption,filesystem,freespace,size,volumename

The VM showed a single C: NTF volume, as well as it's available free space and total size. An attacker could use this information to determine how much storage is available for collected data, temp files, and tools.

MITRE ATT&CK: T1082

8. PowerShell.exe

Run:

powershell.exe -Command "Get-EventLog Security -InstanceId 4624 -Newest 10"

The command returns successful logon events. Event ID 4624 represents a successful windows logon, these events can expose usernames and authentication activity, and attackers could use this information to ID users who have recently logged in.

MITRE ATT&CK: T1033 (execution method: T1059.001)

Task 2 Questions

1. Which binary revealed the most useful information for lateral movement?

I believe netstat did. Showing established connections, listening ports, and PIDs all together gives attackers a clear path they could take to exploit what the host is talking to and what's exposed. Net.exe is very close as it flags privileges accounts, however it doesn't show network paths like netstat does.

2. Which binary's output would be most suspicious to a defender?

Wmic.exe, a depreciated program running is unusual in modern environments, especially creating processes and remote query arguments. PowerShell pulling Event ID 4624 is also suspicious, as normal users don't typically query for security logs.

3. Why might a threat actor use wmic.exe instead of PowerShell for system queries?

Mainly to avoid PowerShell logging, and any execution policy restrictions that PowerShell may trigger. Wmic also works on most systems and can be quicker for one time queries. The trade off there though is as mentioned above, wmic is deprecated so using it is a red flag and not very stealthy.

Task 3 - Execution, Download, and Defense Evasion

Create a temporary working directory:

mkdir C:\temp

1. certutil.exe

echo Harmless Certutil LOLBin demonstration > C:\temp\certutil-original.txt
certutil.exe -encode C:\temp\certutil-original.txt C:\temp\certutil-encoded.txt
del C:\temp\certutil-original.txt
certutil.exe -decode C:\temp\certutil-encoded.txt C:\temp\certutil-decoded.txt
type C:\temp\certutil-decoded.txt

Why this technique evades detection:

Certutil is a legitimate Microsoft certificate utility, but its ability to encode and decode files can also be abused.

Using a trusted Windows binary allows encoded information to be decoded without installing a separate decoding program.

MITRE ATT&CK: T1140

Clean up:

del C:\temp\certutil-encoded.txt
del C:\temp\certutil-decoded.txt

2. PowerShell.exe

powershell.exe -Command "Invoke-WebRequest -Uri 'https://www.example.com/' -OutFile 'C:\temp\powershell-demo.html'"
dir C:\temp\powershell-demo.html

Why this technique evades detection:

Using this command PowerShell can retrieve files over HTTP without requiring a separately download program, and because PowerShell is built into Windows and commonly used for legitimate administration, malicious commands may blend into normal activity.

MITRE ATT&CK: T1059.001 (related: T1105)

Clean up:

del C:\temp\powershell-demo.html

3. wmic.exe

wmic process call create "cmd.exe /c echo Harmless WMIC LOLBin demonstration > C:\temp\wmic-demo.txt"
type C:\temp\wmic-demo.txt

Why this technique evades detection:

WMIC created a new cmd.exe process which wrote the harmless text file.

A threat actor can use WMI to execute commands using built-in Windows management infrastructure instead of introducing a separate execution program.

The Volt Typhoon advisory documents WMIC process creation being used to launch ntdsutil.exe.

MITRE ATT&CK: T1047

Clean up:

del C:\temp\wmic-demo.txt

4. cmd.exe

cmd.exe /c "echo Harmless CMD LOLBin demonstration > C:\temp\cmd-demo.txt"
type C:\temp\cmd-demo.txt

Why this technique evades detection:

CMD is the built-in Windows command interpreter, and because it is usually present on Windows systems and is often used by legitimate software and administrators, simply seeing cmd.exe execute does not automatically indicate malicious activity.

MITRE ATT&CK: T1059.003

Clean up:

del C:\temp\cmd-demo.txt

5. vssadmin.exe

Run the following command to inspect existing shadow copies without changing the system:

vssadmin list shadows

Vssadmin manages the Windows Volume Shadow Copy Service.

Volt Typhoon abused this shadow-copy functionality to access copies of files such as NTDS.dit, which is normally locked while Active Directory is running.

The advisory shows the actor using:

vssadmin create shadow /for=C:

MITRE ATT&CK: T1006

6. netsh.exe

Open Command Prompt as Administrator.

netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=9999 connectaddress=127.0.0.1 connectport=80
netsh interface portproxy show v4tov4

Both addresses are localhost, so the demonstration remains inside the VM.

Why this technique evades detection:

Volt Typhoon abused Netsh PortProxy functionality to redirect traffic through compromised systems. Because the forwarding is handled through a trusted Windows networking utility, it can blend into legitimate administration.

MITRE ATT&CK: T1090 (related: T1112)

Remove the rule:

netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=9999
netsh interface portproxy show v4tov4

Task 3 Questions

1. Which LOLBin can download files without triggering typical firewall alerts?

bitsadmin.exe can use legitimate windows background intelligent transfer service to perform background downloads. BITS is usually used for legitimate downloads and updates, so the network traffic can blend into expected activity.

2. How can regsvr32.exe execute code without writing files to disk?

regsvr32.exe can be used to retrieve and execute remotely hosted scriptlet content using legitimate windows components, the script can be processed without being saved first as a normal exe file, which reduces file based artifacts. regsvr32 is mentioned in the two advisories used for the lab, and the answer for this question covers broader lolbin behavior

3. Why is msbuild.exe dangerous in environments with .NET installed?

msbuild.exe is a legitimate microsoft build utility that has the ability to process project files containing executable build logic including inline .net code. it allows code to execute through a trusted microsoft signed program instead of a suspicious exe file. msbuild is also not discussed in the two advisories uesd for this lab.

Task 4 - LOLBin Detection and Threat Report

Part A - Install and Configure Sysmon

mkdir C:\Sysmon

Download and Place Sysmon64.exe inside C:\Sysmon.

Download the SwiftOnSecurity Sysmon configuration:

powershell.exe -Command "Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml' -OutFile 'C:\Sysmon\sysmonconfig-export.xml'"

Verify:

dir C:\Sysmon\sysmonconfig-export.xml

Open Command Prompt as Administrator.

cd C:\Sysmon
Sysmon64.exe -accepteula -i C:\Sysmon\sysmonconfig-export.xml
Sysmon64.exe -c

Verify the Sysmon event log exists:

wevtutil el | findstr /i sysmon

Expected log: Microsoft-Windows-Sysmon/Operational

Generate Sysmon Process Creation Events

After Sysmon is installed, run:

systeminfo
whoami /all
tasklist /v
wmic path win32_logicaldisk get caption,filesystem,freespace,size,volumename
powershell.exe -Command "Get-Date"

View the Events

Open Event Viewer:

eventvwr.msc

Navigate to: Applications and Services Logs > Microsoft > Windows > Sysmon > Operational

Filter Current Log for Event ID 1.

PowerShell.exe Detection

systeminfo.exe Detection

whoami.exe Detection

tasklist.exe Detection

wmic.exe Detection

LOLBin Detection Script

Create C:\temp\Detect-LOLBins.ps1:

# LOLBin Detection Script - Sysmon Event ID 1

$LogName = "Microsoft-Windows-Sysmon/Operational"

$Rules = @{

    # System discovery: identifies OS/host details.
    "systeminfo.exe" = "T1082 - System Information Discovery"

    # User discovery: identifies current account and security context.
    "whoami.exe" = "T1033 - System Owner/User Discovery"

    # Process discovery: inventories running processes.
    "tasklist.exe" = "T1057 - Process Discovery"

    # WMI execution/discovery: flags WMIC process creation and queries.
    "wmic.exe" = "T1047 - Windows Management Instrumentation"

    # Script execution: flags PowerShell process creation.
    "powershell.exe" = "T1059.001 - PowerShell"

    # Decode behavior: flags Certutil execution for review of arguments.
    "certutil.exe" = "T1140 - Deobfuscate/Decode Files or Information"

    # Native command execution: flags Windows Command Shell activity.
    "cmd.exe" = "T1059.003 - Windows Command Shell"

    # Shadow-copy/direct-volume behavior: flags Vssadmin usage.
    "vssadmin.exe" = "T1006 - Direct Volume Access"

    # Proxy/network modification behavior: flags Netsh execution.
    "netsh.exe" = "T1090 - Proxy"
}

# Read Sysmon process-creation events.
# ErrorAction prevents failure when no matching events exist.

$Events = Get-WinEvent -FilterHashtable @{
    LogName = $LogName
    Id      = 1
} -ErrorAction SilentlyContinue

if (-not $Events) {
    Write-Host "No Sysmon Event ID 1 process creation events were found."
    exit
}

foreach ($Event in $Events) {

    # Convert the event to XML so individual Sysmon fields can be read.
    $Xml = [xml]$Event.ToXml()

    $Data = @{}

    foreach ($Field in $Xml.Event.EventData.Data) {
        $Data[$Field.Name] = $Field.'#text'
    }

    $Binary = [System.IO.Path]::GetFileName($Data["Image"]).ToLower()

    # Display the event if the executable matches one of the rules.
    if ($Rules.ContainsKey($Binary)) {

        [PSCustomObject]@{
            Time        = $Event.TimeCreated
            LOLBin      = $Binary
            MITRE       = $Rules[$Binary]
            User        = $Data["User"]
            Image       = $Data["Image"]
            CommandLine = $Data["CommandLine"]
            ParentImage = $Data["ParentImage"]
        }
    }
}

Run:

powershell.exe -File C:\temp\Detect-LOLBins.ps1

The script searches Sysmon Event ID 1 process-creation events and compares each executable against the LOLBin list.

For matching processes it displays:

Time
LOLBin
MITRE ATT&CK mapping
User
Image path
Command line
Parent image

Threat Report

Executive Summary

Living off the land binaries are legitimate, pre-installed Windows utilities that attackers can repurpose for malicious purposes. Since these tools already exist on the system and are trusted by both users and security software, their use often blends in with normal administrative activity, letting attackers avoid deploying custom malware. This lab examined activity attributed to Volt Typhoon, which relied on native utilities such as WMIC, PowerShell, Netsh, Certutil, and Ntdsutil. Because these tools have entirely legitimate uses, their presence in logs is not inherently suspicious; defenders must instead evaluate the surrounding context, including command line arguments, parent processes, the user account involved, and network activity

LOLBin Documentation

Task 1 documents each selected LOLBin, including:

Full executable path
Legitimate purpose
Abuse method
MITRE ATT&CK mapping

Execution Evidence

Task 2 covers discovery and reconnaissance commands along with screenshots of the resulting output. Task 3 demonstrates benign execution, file download, encoding/decoding, shadow copy inspection, and network traffic forwarding. Task 4 provides Sysmon Event ID 1 evidence capturing execution of the following binaries:

PowerShell
Systeminfo
Whoami
Tasklist
WMIC

Detection Recommendations

Organizations should enable detailed process creation logging so suspicious LOLBin activity can be identified. Sysmon Event ID 1 records process creation and captures useful information such as:

Process image
Command line
User
Parent process
Hashes

Windows Security Event ID 4688 should also be enabled through Audit Process Creation, with command line logging turned on. WMI and PowerShell logging deserve particular attention, since both offer significant execution capability. Rather than alerting simply because a legitimate binary executed, detection should focus on the specific command run and the context surrounding it. Activity that warrants closer investigation includes:

wmic.exe spawning cmd.exe
PowerShell retrieving content from a remote source
netsh.exe creating PortProxy rules
vssadmin.exe accessing shadow copy information

Mitigation Recommendations

Application allowlisting combined with least privilege policies can limit unnecessary use of high risk LOLBins while still preserving required administrative functionality. PowerShell, WMI, command line, and Sysmon logging should all be enabled and forwarded to a centralized logging platform. Group Policy can be configured to enforce process creation auditing and command line logging. High risk utilities including Ntdsutil, WMIC, Certutil, Vssadmin, and Netsh should be monitored for unusual arguments, users, parent processes, execution locations, and network destinations. These utilities should not be blocked outright in every environment, since legitimate Windows administration frequently depends on them.

Tech Journal Submission

Submit your detection script with comments explaining each rule. Submit your threat report formatted for a technical audience (SOC analysts, incident responders).

Task 4 Questions

1. Which LOLBin would be hardest to detect with standard logging?

vssadmin.exe list shadows (or similar shadow copy enumeration) is a strong candidate. Standard Windows logging with only default auditing enabled often does not capture command line arguments at all, so even if the process creation event fires, the analyst sees that vssadmin ran but not what it was asked to do. It is also a completely routine backup and recovery operation, so it rarely appears on any default watchlist, and there is no network or file-write artifact to correlate against.

2. What is the trade-off between blocking LOLBin execution and breaking legitimate system functionality?

Every LOLBin discussed in this lab is also core Windows administrative tooling. Blocking wmic.exe breaks a huge amount of legitimate remote management and inventory scripting. Blocking netsh.exe breaks routine firewall and interface configuration. Blocking powershell.exe breaks most modern IT automation outright. So the trade off is availability versus attack surface. The more aggressively you restrict or disable these binaries, the more you push administrators toward workarounds that can end up weakening security in a different way, and you risk breaking scheduled tasks, monitoring agents, or deployment tooling that quietly depend on them.

3. How would you prioritize which LOLBins to monitor first?

I would make a priority list taking into account impact and rarity of legitimate use. Ntdsutil.exe and vssadmin.exe first on the list, because both can expose domain creds through NTDS.dit access and rarely run outside of maintenance. Next powershell.exe and wmic.exe, the execution tools that see heavy use that is often legitimate, however that means that detection must rely on command line context rather than presence itself. after than come the unusual and baseline discovery tools, netsh.exe and certutil.exe, followed by whoami.exe, systeminfo.exe, and tasklist.exe. The overall logic is to prioritize by: what an attacker gains, credential access first, then execution, then network manipulation, then reconnaissance, rather than by how often a binary appears in advisories.

Formatted with Claude