How many Living-off-the-Land Binaries abuse T1059.005?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1059.005 (T1059.005).

How can detection engineers monitor for T1059.005?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1059.005Tactic: ExecutionOfficial MITRE ATT&CK Page

T1059.005: Technique T1059.005

Adversaries may leverage living-off-the-land techniques (T1059.005) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 1

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1059.005

Across 1 verified binaries

Windows1 payloads

cscript.exe

CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.

Sample Attack Vector:

cscript.exe //B //Nologo %TEMP%\recon.vbs

Inspect cscript.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers