How many Living-off-the-Land Binaries abuse T1547.001?

LOLPulse tracks 1 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1547.001 (T1547.001).

How can detection engineers monitor for T1547.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1547.001Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1547.001: Technique T1547.001

Adversaries may leverage living-off-the-land techniques (T1547.001) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 1

•

Windows: 0

•

Linux: 0

•

macOS: 1

Living-off-the-Land Matrix for T1547.001

Across 1 verified binaries

macOS1 payloads

defaults

Defaults reads and writes macOS user defaults and plist configuration files. Attackers abuse it to write LoginHook scripts or alter ScreenSaver preferences to achieve reboot persistence.

Sample Attack Vector:

defaults write com.apple.loginwindow LoginHook /Library/Scripts/update.sh

Inspect defaults & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers