How many Living-off-the-Land Binaries abuse T1565.001?

LOLPulse tracks 2 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Technique T1565.001 (T1565.001).

How can detection engineers monitor for T1565.001?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1565.001Tactic: Execution & Defense EvasionOfficial MITRE ATT&CK Page

T1565.001: Technique T1565.001

Adversaries may leverage living-off-the-land techniques (T1565.001) to achieve execution, evade defenses, or transfer tools.

Total Capable Binaries: 2

•

Windows: 0

•

Linux: 2

•

macOS: 0

Living-off-the-Land Matrix for T1565.001

Across 2 verified binaries

Linux1 payloads

tee

Tee reads from standard input and writes to standard output and files. Attackers abuse SUID or sudo tee to append unauthorized credentials to /etc/passwd or overwrite system configuration.

Sample Attack Vector:

echo "backdoor:x:0:0::/root:/bin/bash" | tee -a /etc/passwd

Inspect tee & Telemetry

Linux1 payloads

cp

GNU cp copies files. When configured with SUID permissions, attackers can overwrite system authentication files like /etc/passwd or copy binaries with elevated attributes.

Sample Attack Vector:

cp /tmp/passwd_modified /etc/passwd

Inspect cp & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers