How many Living-off-the-Land Binaries abuse T1218.004?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1218.004 (T1218.004).

How can detection engineers monitor for T1218.004?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1218.004Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1218.004: Technique T1218.004

Adversaries may leverage living-off-the-land techniques (T1218.004) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 1

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1218.004

Across 1 verified binaries

Windows3 payloads

Installutil.exe

The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies

Sample Attack Vector:

InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}

Inspect Installutil.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers