How many Living-off-the-Land Binaries abuse T1055?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1055 (T1055).

How can detection engineers monitor for T1055?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1055Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1055: Technique T1055

Adversaries may leverage living-off-the-land techniques (T1055) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 1

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1055

Across 1 verified binaries

Windows3 payloads

coregen.exe

Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.

Sample Attack Vector:

coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

Inspect coregen.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers