How many Living-off-the-Land Binaries abuse T1562.001?

LOLPulse tracks 3 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1562.001 (T1562.001).

How can detection engineers monitor for T1562.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1562.001Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1562.001: Technique T1562.001

Adversaries may leverage living-off-the-land techniques (T1562.001) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 3

•

Windows: 1

•

Linux: 0

•

macOS: 2

Living-off-the-Land Matrix for T1562.001

Across 3 verified binaries

Windows1 payloads

fltMC.exe

Filter Manager Control Program used by Windows

Sample Attack Vector:

fltMC.exe unload SysmonDrv

Inspect fltMC.exe & Telemetry

macOS1 payloads

tccutil

Tccutil manages the Transparency, Consent, and Control (TCC) privacy database. Attackers reset permissions for applications to force prompt re-evaluation or test TCC bypasses.

Sample Attack Vector:

tccutil reset All com.apple.Terminal

Inspect tccutil & Telemetry

macOS1 payloads

networksetup

Networksetup configures macOS network preferences. Attackers abuse it to configure rogue HTTP web proxies or reassign DNS servers to malicious resolvers.

Sample Attack Vector:

networksetup -setwebproxy "Wi-Fi" 127.0.0.1 8080

Inspect networksetup & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers