How many Living-off-the-Land Binaries abuse T1040?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1040 (T1040).

How can detection engineers monitor for T1040?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1040Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1040: Technique T1040

Adversaries may leverage living-off-the-land techniques (T1040) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 2

•

Windows: 2

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1040

Across 2 verified binaries

Windows2 payloads

Pktmon.exe

Capture Network Packets on the windows 10 with October 2018 Update or later.

Sample Attack Vector:

pktmon.exe start --etw

Inspect Pktmon.exe & Telemetry

Windows1 payloads

Nmcap.exe

Command-line packet capture utility from Microsoft Network Monitor 3.x.

Sample Attack Vector:

nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}

Inspect Nmcap.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers