How many Living-off-the-Land Binaries abuse T1220?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1220 (T1220).

How can detection engineers monitor for T1220?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1220Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1220: Technique T1220

Adversaries may leverage living-off-the-land techniques (T1220) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 2

•

Windows: 2

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1220

Across 2 verified binaries

Windows3 payloads

winrm.vbs

Script used for manage Windows RM settings

Sample Attack Vector:

winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985

Inspect winrm.vbs & Telemetry

Windows6 payloads

msxsl.exe

Command line utility used to perform XSL transformations.

Sample Attack Vector:

msxsl.exe {PATH:.xml} {PATH:.xsl}

Inspect msxsl.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers