How many Living-off-the-Land Binaries abuse T1202?

LOLPulse tracks 24 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1202 (T1202).

How can detection engineers monitor for T1202?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1202Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1202: Technique T1202

Adversaries may leverage living-off-the-land techniques (T1202) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 24

•

Windows: 24

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1202

Across 24 verified binaries

Windows5 payloads

Bash.exe

File used by Windows subsystem for Linux

Sample Attack Vector:

bash.exe -c "{CMD}"

Inspect Bash.exe & Telemetry

Windows2 payloads

Conhost.exe

Console Window host

Sample Attack Vector:

conhost.exe {CMD}

Inspect Conhost.exe & Telemetry

Windows2 payloads

Diskshadow.exe

Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).

Sample Attack Vector:

diskshadow.exe /s {PATH:.txt}

Inspect Diskshadow.exe & Telemetry

Windows2 payloads

Explorer.exe

Binary used for managing files and system components within Windows

Sample Attack Vector:

explorer.exe /root,"{PATH_ABSOLUTE:.exe}"

Inspect Explorer.exe & Telemetry

Windows2 payloads

Forfiles.exe

Selects and executes a command on a file or set of files. This command is useful for batch processing.

Sample Attack Vector:

forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"

Inspect Forfiles.exe & Telemetry

Windows2 payloads

Ftp.exe

A binary designed for connecting to FTP servers

Sample Attack Vector:

echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

Inspect Ftp.exe & Telemetry

Windows3 payloads

Msdt.exe

Microsoft diagnostics tool

Sample Attack Vector:

msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE

Inspect Msdt.exe & Telemetry

Windows3 payloads

Pcalua.exe

Program Compatibility Assistant

Sample Attack Vector:

pcalua.exe -a {PATH:.exe}

Inspect Pcalua.exe & Telemetry

Windows2 payloads

Pcwrun.exe

Program Compatibility Wizard

Sample Attack Vector:

Pcwrun.exe {PATH_ABSOLUTE:.exe}

Inspect Pcwrun.exe & Telemetry

Windows3 payloads

scp.exe

Used for uploading or downloading files over SSH.

Sample Attack Vector:

scp.exe -o ProxyCommand="{CMD}" . localhost:.

Inspect scp.exe & Telemetry

Windows2 payloads

Scriptrunner.exe

Execute binary through proxy binary to evade defensive counter measures

Sample Attack Vector:

Scriptrunner.exe -appvscript {PATH:.exe}

Inspect Scriptrunner.exe & Telemetry

Windows2 payloads

Sftp.exe

sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.

Sample Attack Vector:

sftp -o ProxyCommand="{CMD}" .

Inspect Sftp.exe & Telemetry

Windows3 payloads

ssh.exe

Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.

Sample Attack Vector:

ssh localhost "{CMD}"

Inspect ssh.exe & Telemetry

Windows1 payloads

Unregmp2.exe

Microsoft Windows Media Player Setup Utility

Sample Attack Vector:

rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"

Inspect Unregmp2.exe & Telemetry

Windows1 payloads