How many Living-off-the-Land Binaries abuse T1548.001?

LOLPulse tracks 15 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Setuid and Setgid (T1548.001).

How can detection engineers monitor for T1548.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1548.001Tactic: Privilege EscalationOfficial MITRE ATT&CK Page

T1548.001: Setuid and Setgid

Adversaries may abuse SUID or SGID bits on binaries like find, bash, or python to escalate privileges to root.

Total Capable Binaries: 15

•

Windows: 0

•

Linux: 15

•

macOS: 0

Living-off-the-Land Matrix for T1548.001

Across 15 verified binaries

Linux1 payloads

find

Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.

Sample Attack Vector:

find . -name "*.conf" -exec /bin/sh -p \;

Inspect find & Telemetry

Linux1 payloads

bash

The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.

Sample Attack Vector:

bash -p

Inspect bash & Telemetry

Linux1 payloads

awk

AWK is a pattern scanning and processing language. Because AWK includes built-in system() functions and file operations, SUID awk or sudo privileges can be trivially abused to break out of restricted environments and spawn shells.

Sample Attack Vector:

awk 'BEGIN {system("/bin/sh")}'

Inspect awk & Telemetry

Linux1 payloads

tar

GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.

Sample Attack Vector:

tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Inspect tar & Telemetry

Linux1 payloads

vim

Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.

Sample Attack Vector:

vim -c ':!/bin/sh'

Inspect vim & Telemetry

Linux1 payloads

env

Env runs a program in a modified environment. When configured with the SUID bit or unrestricted sudo access, running env to launch a shell preserves elevated root EUID permissions.

Sample Attack Vector:

env /bin/sh -p

Inspect env & Telemetry

Linux1 payloads

gdb

GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.

Sample Attack Vector:

gdb -nx -ex '!sh' -ex quit

Inspect gdb & Telemetry

Linux1 payloads

cp

GNU cp copies files. When configured with SUID permissions, attackers can overwrite system authentication files like /etc/passwd or copy binaries with elevated attributes.

Sample Attack Vector:

cp /tmp/passwd_modified /etc/passwd

Inspect cp & Telemetry

Linux1 payloads

chmod

Chmod alters file mode bits. SUID or sudo chmod is abused to turn standard shells into persistent SUID root binaries by adding the 4755 permission bit.

Sample Attack Vector:

chmod 4755 /bin/dash

Inspect chmod & Telemetry

Linux1 payloads