How many Living-off-the-Land Binaries abuse T1127?

LOLPulse tracks 40 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1127 (T1127).

How can detection engineers monitor for T1127?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1127Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1127: Technique T1127

Adversaries may leverage living-off-the-land techniques (T1127) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 40

•

Windows: 40

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1127

Across 40 verified binaries

Windows0 payloads

Applaunch.exe

Microsoft .NET ClickOnce Launch Utility.

Inspect Applaunch.exe & Telemetry

Windows1 payloads

Aspnet_Compiler.exe

ASP.NET Compilation Tool

Sample Attack Vector:

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u

Inspect Aspnet_Compiler.exe & Telemetry

Windows2 payloads

Csc.exe

Binary file used by .NET Framework to compile C# code

Sample Attack Vector:

csc.exe -out:{PATH:.exe} {PATH:.cs}

Inspect Csc.exe & Telemetry

Windows0 payloads

Dfsvc.exe

ClickOnce engine in Windows used by .NET

Inspect Dfsvc.exe & Telemetry

Windows2 payloads

Ilasm.exe

used for compile c# code into dll or exe.

Sample Attack Vector:

ilasm.exe {PATH_ABSOLUTE:.txt} /exe

Inspect Ilasm.exe & Telemetry

Windows2 payloads

Jsc.exe

Binary file used by .NET to compile JavaScript code to .exe or .dll format

Sample Attack Vector:

jsc.exe {PATH:.js}

Inspect Jsc.exe & Telemetry

Windows3 payloads

Microsoft.Workflow.Compiler.exe

A utility included with .NET that is capable of compiling and executing C# or VB.net code.

Sample Attack Vector:

Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}

Inspect Microsoft.Workflow.Compiler.exe & Telemetry

Windows0 payloads

Msbuild.exe

Used to compile and execute code

Inspect Msbuild.exe & Telemetry

Windows2 payloads

Ttdinject.exe

Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)

Sample Attack Vector:

TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"

Inspect Ttdinject.exe & Telemetry

Windows2 payloads

Tttracer.exe

Used by Windows 1809 and newer to Debug Time Travel

Sample Attack Vector:

tttracer.exe {PATH_ABSOLUTE:.exe}

Inspect Tttracer.exe & Telemetry

Windows2 payloads

vbc.exe

Binary file used for compile vbs code

Sample Attack Vector:

vbc.exe /target:exe {PATH_ABSOLUTE:.vb}

Inspect vbc.exe & Telemetry

Windows0 payloads

Dfshim.dll

ClickOnce engine in Windows used by .NET

Inspect Dfshim.dll & Telemetry

Windows4 payloads

adplus.exe

Debugging tool included with Windows Debugging Tools

Sample Attack Vector:

adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet

Inspect adplus.exe & Telemetry

Windows2 payloads

AppCert.exe

Windows App Certification Kit command-line tool.

Sample Attack Vector:

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Inspect AppCert.exe & Telemetry

Windows1 payloads

AppLauncher.exe

User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.

Sample Attack Vector:

AppLauncher.exe {PATH_ABSOLUTE:.exe}

Inspect AppLauncher.exe & Telemetry

Windows3 payloads

Cdb.exe

Debugging tool included with Windows Debugging Tools.

Sample Attack Vector:

cdb.exe -cf {PATH:.wds} -o notepad.exe

Inspect Cdb.exe & Telemetry

Windows1 payloads

csi.exe

Command line interface included with Visual Studio.

Sample Attack Vector:

csi.exe {PATH:.cs}

Inspect csi.exe & Telemetry

Windows2 payloads

DbgSrv.exe

A process server included with Debugging Tools for Windows for remote user-mode debugging.

Sample Attack Vector:

dbgsrv.exe -t tcp:port=5005 -c {CMD}

Inspect DbgSrv.exe & Telemetry

Windows2 payloads

Devtoolslauncher.exe

Binary will execute specified binary. Part of VS/VScode installation.

Sample Attack Vector:

devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" test

Inspect Devtoolslauncher.exe & Telemetry

Windows1 payloads

dnx.exe

.NET Execution environment file included with .NET.

Sample Attack Vector:

dnx.exe {PATH_ABSOLUTE:folder}

Inspect dnx.exe & Telemetry

Windows1 payloads

dotnet-counters.exe

.NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET SDK required).

Sample Attack Vector:

dotnet-counters.exe collect --duration 1 -- {PATH:.exe}

Inspect dotnet-counters.exe & Telemetry

Windows1 payloads

dotnet-trace.exe

.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required).

Sample Attack Vector:

dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe}

Inspect dotnet-trace.exe & Telemetry

Windows2 payloads

Dxcap.exe

DirectX diagnostics/debugger included with Visual Studio.

Sample Attack Vector:

Dxcap.exe -c {PATH_ABSOLUTE:.exe}

Inspect Dxcap.exe & Telemetry

Windows1 payloads

IntelliTrace.exe

Visual Studio command-line tool for collecting and managing diagnostic trace files.

Sample Attack Vector:

IntelliTrace.exe launch /cp:"collectionplan.xml" /f:"c:\users\public\log" "C:\Windows\System32\calc.exe"

Inspect IntelliTrace.exe & Telemetry

Windows1 payloads

Mftrace.exe

Trace log generation tool for Media Foundation Tools.

Sample Attack Vector:

Mftrace.exe {PATH:.exe}

Inspect Mftrace.exe & Telemetry

Windows1 payloads

Microsoft.NodejsTools.PressAnyKey.exe

Part of the NodeJS Visual Studio tools.

Sample Attack Vector:

Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}

Inspect Microsoft.NodejsTools.PressAnyKey.exe & Telemetry

Windows1 payloads

Mpiexec.exe

Command-line tool for running Message Passing Interface (MPI) applications.

Sample Attack Vector:

mpiexec.exe {CMD}

Inspect Mpiexec.exe & Telemetry

Windows1 payloads

Ntsd.exe

Symbolic Debugger for Windows.

Sample Attack Vector:

ntsd.exe -g {CMD}

Inspect Ntsd.exe & Telemetry

Windows1 payloads

Pixtool.exe

Command line utility for taking and analyzing PIX GPU captures.

Sample Attack Vector:

pixtool.exe launch {PATH_ABSOLUTE:.exe}

Inspect Pixtool.exe & Telemetry

Windows2 payloads

rcsi.exe

Non-Interactive command line inerface included with Visual Studio.

Sample Attack Vector:

rcsi.exe {PATH:.csx}

Inspect rcsi.exe & Telemetry

Windows3 payloads

Remote.exe

Debugging tool included with Windows Debugging Tools

Sample Attack Vector:

Remote.exe /s {PATH:.exe} anythinghere

Inspect Remote.exe & Telemetry

Windows2 payloads

te.exe

Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).

Sample Attack Vector:

te.exe {PATH:.wsc}

Inspect te.exe & Telemetry

Windows2 payloads

Tracker.exe

Tool included with Microsoft .Net Framework.

Sample Attack Vector:

Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Inspect Tracker.exe & Telemetry

Windows2 payloads

VSDiagnostics.exe

Command-line tool used for performing diagnostics.

Sample Attack Vector:

VSDiagnostics.exe start 1 /launch:{PATH:.exe}

Inspect VSDiagnostics.exe & Telemetry

Windows1 payloads

vsjitdebugger.exe

Just-In-Time (JIT) debugger included with Visual Studio

Sample Attack Vector:

Vsjitdebugger.exe {PATH:.exe}

Inspect vsjitdebugger.exe & Telemetry

Windows3 payloads

VSLaunchBrowser.exe

Microsoft Visual Studio browser launcher tool for web applications debugging

Sample Attack Vector:

VSLaunchBrowser.exe .exe {REMOTEURL:.exe}

Inspect VSLaunchBrowser.exe & Telemetry

Windows1 payloads

vstest.console.exe

VSTest.Console.exe is the command-line tool to run tests

Sample Attack Vector:

vstest.console.exe {PATH:.dll}

Inspect vstest.console.exe & Telemetry

Windows1 payloads

Wfc.exe

The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).

Sample Attack Vector:

wfc.exe {PATH_ABSOLUTE:.xoml}

Inspect Wfc.exe & Telemetry

Windows1 payloads

WFMFormat.exe

Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Sample Attack Vector:

WFMFormat.exe

Inspect WFMFormat.exe & Telemetry

Windows1 payloads

WinDbg.exe

Windows Debugger for advanced user-mode and kernel-mode debugging.

Sample Attack Vector:

windbg.exe -g {CMD}

Inspect WinDbg.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers