How many Living-off-the-Land Binaries abuse T1547?

LOLPulse tracks 3 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1547 (T1547).

How can detection engineers monitor for T1547?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1547Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1547: Technique T1547

Adversaries may leverage living-off-the-land techniques (T1547) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 3

•

Windows: 2

•

Linux: 0

•

macOS: 1

Living-off-the-Land Matrix for T1547

Across 3 verified binaries

Windows1 payloads

Pnputil.exe

Used for installing drivers

Sample Attack Vector:

pnputil.exe -i -a {PATH_ABSOLUTE:.inf}

Inspect Pnputil.exe & Telemetry

Windows13 payloads

Update.exe

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Sample Attack Vector:

Update.exe --download {REMOTEURL}

Inspect Update.exe & Telemetry

macOS0 payloads

defaults

Defaults reads and writes macOS user defaults and plist configuration files. Attackers abuse it to write LoginHook scripts or alter ScreenSaver preferences to achieve reboot persistence.

Inspect defaults & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers