How many Living-off-the-Land Binaries abuse T1082?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute System Information Discovery (T1082).

How can detection engineers monitor for T1082?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1082Tactic: DiscoveryOfficial MITRE ATT&CK Page

T1082: System Information Discovery

Adversaries may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.

Total Capable Binaries: 2

•

Windows: 0

•

Linux: 0

•

macOS: 2

Living-off-the-Land Matrix for T1082

Across 2 verified binaries

macOS1 payloads

scutil

Scutil manages system configuration parameters. Attackers use it during discovery to retrieve the computer name, DNS servers, and network proxy configurations.

Sample Attack Vector:

scutil --get ComputerName

Inspect scutil & Telemetry

macOS1 payloads

csrutil

Csrutil inspects and modifies System Integrity Protection (SIP) settings. Attackers check SIP status prior to attempting kernel extensions or rootkit loading.

Sample Attack Vector:

csrutil status

Inspect csrutil & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers