How many Living-off-the-Land Binaries abuse T1003.001?

LOLPulse tracks 6 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1003.001 (T1003.001).

How can detection engineers monitor for T1003.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1003.001Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1003.001: Technique T1003.001

Adversaries may leverage living-off-the-land techniques (T1003.001) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 6

•

Windows: 6

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1003.001

Across 6 verified binaries

Windows3 payloads

rdrleakdiag.exe

Microsoft Windows resource leak diagnostic tool

Sample Attack Vector:

rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Inspect rdrleakdiag.exe & Telemetry

Windows1 payloads

Comsvcs.dll

COM+ Services

Sample Attack Vector:

rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin full

Inspect Comsvcs.dll & Telemetry

Windows4 payloads

adplus.exe

Debugging tool included with Windows Debugging Tools

Sample Attack Vector:

adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet

Inspect adplus.exe & Telemetry

Windows1 payloads

Dump64.exe

Memory dump tool that comes with Microsoft Visual Studio

Sample Attack Vector:

dump64.exe {PID} out.dmp

Inspect Dump64.exe & Telemetry

Windows1 payloads

DumpMinitool.exe

Dump tool part Visual Studio 2022

Sample Attack Vector:

DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType Full

Inspect DumpMinitool.exe & Telemetry

Windows2 payloads

Sqldumper.exe

Debugging utility included with Microsoft SQL.

Sample Attack Vector:

sqldumper.exe 464 0 0x0110

Inspect Sqldumper.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers