How many Living-off-the-Land Binaries abuse T1543.001?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1543.001 (T1543.001).

How can detection engineers monitor for T1543.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1543.001Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1543.001: Technique T1543.001

Adversaries may leverage living-off-the-land techniques (T1543.001) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 2

•

Windows: 0

•

Linux: 0

•

macOS: 2

Living-off-the-Land Matrix for T1543.001

Across 2 verified binaries

macOS1 payloads

plutil

Plutil checks and transforms property list (.plist) files. Attackers use plutil -insert to inject payload paths into LaunchAgent or LaunchDaemon plists for persistence.

Sample Attack Vector:

plutil -insert ProgramArguments.0 -string "/bin/sh" ~/Library/LaunchAgents/com.apple.updater.plist

Inspect plutil & Telemetry

macOS1 payloads

launchctl

Launchctl interfaces with launchd to manage daemons and user agents. Malware uses launchctl to immediately bootstrap and execute persistent services.

Sample Attack Vector:

launchctl load -w ~/Library/LaunchAgents/com.persistence.plist

Inspect launchctl & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers