How many Living-off-the-Land Binaries abuse T1562?

LOLPulse tracks 4 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1562 (T1562).

How can detection engineers monitor for T1562?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1562Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1562: Technique T1562

Adversaries may leverage living-off-the-land techniques (T1562) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 4

•

Windows: 2

•

Linux: 0

•

macOS: 2

Living-off-the-Land Matrix for T1562

Across 4 verified binaries

Windows2 payloads

Cipher.exe

File Encryption Utility

Sample Attack Vector:

cipher /w:{PATH_ABSOLUTE:folder}

Inspect Cipher.exe & Telemetry

Windows0 payloads

fltMC.exe

Filter Manager Control Program used by Windows

Inspect fltMC.exe & Telemetry

macOS0 payloads

tccutil

Tccutil manages the Transparency, Consent, and Control (TCC) privacy database. Attackers reset permissions for applications to force prompt re-evaluation or test TCC bypasses.

Inspect tccutil & Telemetry

macOS0 payloads

networksetup

Networksetup configures macOS network preferences. Attackers abuse it to configure rogue HTTP web proxies or reassign DNS servers to malicious resolvers.

Inspect networksetup & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers