How many Living-off-the-Land Binaries abuse T1539?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1539 (T1539).

How can detection engineers monitor for T1539?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1539Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1539: Technique T1539

Adversaries may leverage living-off-the-land techniques (T1539) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 0

•

macOS: 1

Living-off-the-Land Matrix for T1539

Across 1 verified binaries

macOS1 payloads

sqlite3

Sqlite3 queries SQLite databases. Attackers use it to query Chrome and Safari cookies, browsing history, and notes databases without launching browsers.

Sample Attack Vector:

sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/Cookies "SELECT host_key, name, encrypted_value FROM cookies"

Inspect sqlite3 & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers