How many Living-off-the-Land Binaries abuse T1548.002?

LOLPulse tracks 6 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Bypass User Account Control (T1548.002).

How can detection engineers monitor for T1548.002?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1548.002Tactic: Privilege EscalationOfficial MITRE ATT&CK Page

T1548.002: Bypass User Account Control

Adversaries may bypass UAC mechanisms to elevate process privileges on Windows systems.

Total Capable Binaries: 6

•

Windows: 6

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1548.002

Across 6 verified binaries

Windows1 payloads

ComputerDefaults.exe

ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.

Sample Attack Vector:

ComputerDefaults.exe

Inspect ComputerDefaults.exe & Telemetry

Windows1 payloads

Eudcedit.exe

Private Character Editor Windows Utility

Sample Attack Vector:

eudcedit

Inspect Eudcedit.exe & Telemetry

Windows2 payloads

Eventvwr.exe

Displays Windows Event Logs in a GUI window.

Sample Attack Vector:

eventvwr.exe

Inspect Eventvwr.exe & Telemetry

Windows2 payloads

iscsicpl.exe

Microsoft iSCSI Initiator Control Panel tool

Sample Attack Vector:

c:\windows\syswow64\iscsicpl.exe

Inspect iscsicpl.exe & Telemetry

Windows1 payloads

odbcad32.exe

ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.

Sample Attack Vector:

odbcad32.exe

Inspect odbcad32.exe & Telemetry

Windows1 payloads

Wsreset.exe

Used to reset Windows Store settings according to its manifest file

Sample Attack Vector:

wsreset.exe

Inspect Wsreset.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers