Living-Off-the-Land

AI coding assistants including OpenClaw, Moltbot, and Clawdbot are being weaponized via malicious 'ClawHub' registry skills to execute unauthorized system commands and exfiltrate cryptocurrency and credential data.

Adversaries are abusing the AWS Systems Manager SendCommand API to remotely execute commands on EC2 instances by leveraging legitimate system utilities (LOLBins) to bypass CloudTrail parameter redaction.

Threat actors, including Rhysida and Storm-0501, abuse native Microsoft Azure storage utilities as living-off-the-land binaries to exfiltrate data from compromised endpoints to attacker-controlled cloud storage.

Adversaries often execute 'crontab -l' to enumerate existing scheduled tasks, enabling the discovery of persistence mechanisms, legitimate job hijacking targets, or privilege escalation opportunities.

Adversaries frequently leverage the C# compiler (csc.exe) to compile malicious code on-the-fly, often triggered by suspicious parent processes such as office applications or script engines.

Adversaries leverage the signed Windows binary mavinject.exe to perform unauthorized process injection by executing DLLs into running system processes.

Adversaries leverage the native .NET InstallUtil.exe utility with specific flags to execute arbitrary code while bypassing standard logging and console output mechanisms.

Adversaries leverage the native Windows utility InfDefaultInstall.exe to execute malicious script content embedded within specially crafted INF files.

This rule identifies the use of the '<' operator with cmd.exe to read content from files or streams, a technique often used by attackers to bypass execution policy restrictions or bypass basic file-based detection.

Adversaries leverage the MSXML2 COM object within PowerShell scripts to facilitate network communication and potential code execution.

This brief documents a detection method for identifying potentially malicious PowerShell scripts that decode base64-encoded Gzip archives to facilitate in-memory code execution.

Adversaries often abuse legitimate remote access software like GoToAssist to establish interactive command-and-control channels, leaving specific temporary artifacts in the user's local profile.

Adversaries frequently utilize script interpreters such as cscript, wscript, and mshta from non-standard or user-writable directories to execute malicious payloads while evading security controls.

Adversaries are utilizing the native Windows script GatherNetworkInfo.vbs to perform system reconnaissance and collect network configuration data.

Adversaries are leveraging legitimate Windows command-line tools such as PowerShell, curl, and wget to collect system information and exfiltrate data via HTTP POST requests.

Adversaries may rename the legitimate createdump.exe utility to evade detection while performing unauthorized process memory dumps for credential access.

Detection of attackers using the Windows mshta.exe utility to execute malicious JavaScript code for living-off-the-land stealth execution.

Adversaries utilize the legitimate Windows mshta.exe utility to execute remote malicious HTA files, bypassing security controls by fetching code directly from web-based infrastructure.

Adversaries utilize the Windows mklink utility to create symbolic links to Volume Shadow Copies, enabling unauthorized access to sensitive files like the SAM database for credential theft.

This brief documents detection logic for identifying potential malicious file downloads and C2 communication using native Windows command-line tools and PowerShell cmdlets.

Adversaries frequently abuse native Windows utilities like vssadmin and wmic to create volume shadow copies, a precursor to offline credential theft via NTDS.dit extraction.

Adversaries may execute malicious payloads by leveraging rundll32.exe with non-standard file extensions to bypass simple filename-based security controls.

Adversaries utilize the Python '-c' flag to execute arbitrary code or payloads directly from the command line, bypassing file-based execution triggers.

Attackers can leverage the legitimate Windows print.exe utility to perform unauthorized remote file copying, facilitating data staging and exfiltration.

Adversaries leverage the Windows Installer service (msiexec.exe) to download and execute malicious MSI packages directly from remote web URLs to facilitate stage-two payload delivery.

Attackers can leverage the findstr.exe utility to download or read content from remote SMB shares using specific command-line arguments, potentially facilitating file exfiltration or second-stage payload delivery.

Detection of suspicious network activity where Windows script interpreters (Wscript.exe and Cscript.exe) initiate connections to local IP ranges.

Adversaries utilize Windows script engines, wscript.exe and cscript.exe, to initiate outbound network connections for downloading malicious payloads or communicating with command and control infrastructure.

Adversaries utilize the native Windows 'arp.exe' utility to perform network reconnaissance, mapping active hosts to facilitate lateral movement within compromised environments.

Adversaries frequently abuse the legitimate curl command-line utility to exfiltrate collected sensitive data to external Command and Control (C2) servers via network protocols.

Adversaries leverage the Windows Installer utility msiexec.exe to proxy the quiet execution of malicious payloads, bypassing traditional security controls by masquerading as legitimate installation processes.

This brief details the abuse of the Windows utility msiexec.exe by attackers to download and execute remote files via HTTP or HTTPS URLs, often leading to unauthorized code execution, system compromise, or further malware deployment.

This threat brief details the detection of adversaries leveraging the legitimate Windows Background Intelligent Transfer Service (BITSAdmin) utility to download malicious payloads from suspicious file-sharing and cloud storage domains, a technique commonly employed by ransomware groups and APTs for ingress tool transfer and stealthy execution.

Adversaries leverage the native Windows Management Instrumentation Command-line (WMIC) utility to terminate applications, specifically security products, as a defense evasion technique.

A high-severity threat involves adversaries abusing `wmic.exe` to create new processes like `rundll32` or `powershell` on Windows systems, a technique observed in ransomware campaigns such as Ryuk, Hive, and Conti, indicating post-compromise execution.

Threat actor Volt Typhoon is observed using the built-in Windows Management Instrumentation Command-line (WMIC.EXE) utility to perform system and volume discovery, gathering critical system information that can facilitate further network exploitation and data exfiltration.

Unidentified threat actors may leverage the legitimate Microsoft Sysinternals PsSuspend utility to suspend critical processes on Windows systems, enabling evasion of security controls or disruption of operations.

The execution of a renamed Microsoft Sysinternals Sdelete utility is a highly suspicious technique often employed by adversaries to destroy data on Windows systems, leading to severe impact on system integrity and data availability.

This brief describes the detection of Living Off The Land Binaries (LOLBINs) and legitimate Windows applications being abused to drop various script files to disk, indicating malware staging or script-based code execution attempts.

This brief details a detection method for identifying malicious activity where legitimate Windows applications, including Living-Off-The-Land Binaries (LOLBINs) and common productivity software, are abused to drop executable files onto the disk, often indicating malware staging, persistence mechanisms, or process injection attempts.

An unknown threat actor gained continuous administrative access to a senior finance executive's Microsoft Outlook mailbox at a global stock exchange for at least five months, deploying custom infostealers via scheduled tasks and exfiltrating sensitive emails through a Dropbox-based command and control channel after an initial lateral movement event.

This correlation search identifies multiple risk events associated with 'Living Off The Land' activity, leveraging the Risk data model to aggregate events, focusing on systems with a high count of distinct sources, potentially enabling attackers to execute code, escalate privileges, or persist within the environment using trusted system utilities.

Detection of PowerShell execution initiated via Crowdstrike Real Time Response (RTR) 'runscript' command, potentially indicating malicious actors leveraging compromised Crowdstrike Dashboard access to execute commands on remote hosts using encoded commands.

The analytic identifies instances where wmiprvse.exe spawns msbuild.exe, an unusual process relationship indicative of potential COM object misuse and unauthorized code execution on Windows systems.

Attackers are abusing the Windows Defender command-line utility, MpCmdRun.exe, to download malicious files from remote URLs, enabling them to introduce malware or offensive tooling into compromised environments.

Detection of msbuild.exe execution from a non-standard path, indicating potential attempts to evade detection and execute malicious code.

The use of Microsoft Workflow Compiler (microsoft.workflow.compiler.exe), a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319, can indicate malicious intent such as code execution or persistence mechanisms, potentially leading to unauthorized access.

Detection of the renaming of microsoft.workflow.compiler.exe, a technique used by attackers to evade security controls and potentially execute arbitrary code for privilege escalation or persistence.

Detection of regasm.exe spawning a child process, an unusual behavior that may indicate attempts to bypass application control and execute arbitrary code.

Detection of netsh.exe execution by unusual processes indicative of potential malicious activity, including persistence and network configuration changes by threat actors.