How many Living-off-the-Land Binaries abuse T1216?

LOLPulse tracks 10 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1216 (T1216).

How can detection engineers monitor for T1216?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1216Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1216: Technique T1216

Adversaries may leverage living-off-the-land techniques (T1216) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 10

•

Windows: 10

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1216

Across 10 verified binaries

Windows1 payloads

CL_Invocation.ps1

Aero diagnostics script

Sample Attack Vector:

. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke {CMD}

Inspect CL_Invocation.ps1 & Telemetry

Windows1 payloads

CL_LoadAssembly.ps1

PowerShell Diagnostic Script

Sample Attack Vector:

powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"

Inspect CL_LoadAssembly.ps1 & Telemetry

Windows1 payloads

CL_Mutexverifiers.ps1

Proxy execution with CL_Mutexverifiers.ps1

Sample Attack Vector:

. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess {PATH:.ps1}

Inspect CL_Mutexverifiers.ps1 & Telemetry

Windows2 payloads

Launch-VsDevShell.ps1

Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet

Sample Attack Vector:

powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}

Inspect Launch-VsDevShell.ps1 & Telemetry

Windows2 payloads

Manage-bde.wsf

Script for managing BitLocker

Sample Attack Vector:

set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsf

Inspect Manage-bde.wsf & Telemetry

Windows2 payloads

Pester.bat

Used as part of the Powershell pester

Sample Attack Vector:

Pester.bat [/help|?|-?|/?] "$null; {CMD}"

Inspect Pester.bat & Telemetry

Windows0 payloads

Pubprn.vbs

Proxy execution with Pubprn.vbs

Inspect Pubprn.vbs & Telemetry

Windows0 payloads

Syncappvpublishingserver.vbs

Script used related to app-v and publishing server

Inspect Syncappvpublishingserver.vbs & Telemetry

Windows1 payloads

UtilityFunctions.ps1

PowerShell Diagnostic Script

Sample Attack Vector:

powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"

Inspect UtilityFunctions.ps1 & Telemetry

Windows3 payloads

winrm.vbs

Script used for manage Windows RM settings

Sample Attack Vector:

winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985

Inspect winrm.vbs & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers