How many Living-off-the-Land Binaries abuse T1036?

LOLPulse tracks 4 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1036 (T1036).

How can detection engineers monitor for T1036?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1036Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1036: Technique T1036

Adversaries may leverage living-off-the-land techniques (T1036) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 4

•

Windows: 4

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1036

Across 4 verified binaries

Windows0 payloads

Colorcpl.exe

Binary that handles color management

Inspect Colorcpl.exe & Telemetry

Windows3 payloads

Diantz.exe

Binary that package existing files into a cabinet (.cab) file

Sample Attack Vector:

diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab

Inspect Diantz.exe & Telemetry

Windows4 payloads

Makecab.exe

Binary to package existing files into a cabinet (.cab) file

Sample Attack Vector:

makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab

Inspect Makecab.exe & Telemetry

Windows5 payloads

Msbuild.exe

Used to compile and execute code

Sample Attack Vector:

msbuild.exe {PATH:.xml}

Inspect Msbuild.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers