Living-Off-the-Land

Adversaries may abuse the legitimate msiexec.exe binary to execute arbitrary code contained within a DLL by invoking the DllUnregisterServer function.

Detection logic for identifying when known LOLBins write files to suspicious or uncommon directories to evade security controls.

This brief documents the detection of WMI 'process call create' command-line patterns used by adversaries to execute arbitrary payloads and maintain persistence.

Adversaries leverage the signed Windows script Syncappvpublishingserver.vbs via wscript.exe or cscript.exe to execute remote scripts or facilitate defense evasion and privilege escalation.

Threat actors, including APT41, abuse the native Windows HTML Help application (hh.exe) to decompile CHM files for staging malicious payloads or bypassing security controls.

The Volt Typhoon group utilizes the Windows netsh utility to establish covert network proxies, enabling persistence and traffic redirection through the portproxy interface.

Attackers are abusing the legitimate Windows utility odbcconf.exe to execute arbitrary code or load malicious DLLs by utilizing response files to bypass security controls.

Attackers are abusing the legitimate Windows utility odbcconf.exe to load arbitrary DLLs via the regsvr action, enabling defense evasion and unauthorized code execution.

Attackers frequently abuse the legitimate, signed Windows utility Odbcconf.exe to execute arbitrary code or load malicious DLLs, facilitating defense evasion and persistence.

Adversaries abuse the msiexec.exe /y command-line switch to trigger the DLLRegisterServer function, facilitating malicious DLL loading for defense evasion and persistence.

Adversaries leverage the signed binary InstallUtil.exe with the /u flag to execute arbitrary code and bypass Windows application control policies.

Attackers utilize the Windows built-in utility 'forfiles.exe' to execute commands against multiple files, a technique leveraged by the Prestige ransomware to facilitate post-exploitation file enumeration and malicious activity.

The Windows 'forfiles.exe' utility can be abused by attackers to execute arbitrary commands as a proxy, enabling evasion of command-line monitoring and facilitating post-exploitation activity.

APT37 leverages the native Windows expand.exe utility to extract malicious CAB archives into common staging directories like C:\ProgramData as a precursor to persistence and execution.

Attackers are abusing the native Windows binary mavinject.exe to perform arbitrary DLL injection into running processes, enabling stealthy code execution and persistence.

Threat actors, including Wizard Spider and FIN6, frequently abuse the legitimate AdFind.exe utility to perform unauthorized Active Directory reconnaissance to facilitate lateral movement and privilege escalation.

Detection of rundll32.exe executing with 'Start' or 'StartW' function parameters, a common technique used by Cobalt Strike payloads to achieve arbitrary code execution and persistence.

This detection focuses on identifying suspicious child processes spawned from 'mshta.exe', a common living-off-the-land technique used by threat actors like Lumma Stealer and MuddyWater for code execution and persistence.

The Microsoft Workflow Compiler (microsoft.workflow.compiler.exe) is being abused as a living-off-the-land technique to execute arbitrary code or maintain persistence via proxy execution.

Adversaries utilize schtasks.exe with remote command-line arguments to establish persistence or facilitate lateral movement across Windows environments.

This brief describes the detection of adversaries abusing 'schtasks.exe' for lateral movement and remote code execution by triggering scheduled tasks on remote Windows endpoints.

Adversaries frequently use schtasks.exe via command interpreters to establish persistence or execute malicious payloads; this detection monitors for abnormal task creation or deletion originating from non-system processes.

Adversaries leverage the rundll32.exe utility to execute malicious DLL export functions by ordinal value, a technique designed to evade standard process monitoring and security controls.

Adversaries leverage the Windows Management Instrumentation (WMI) utility (wmic.exe) to facilitate lateral movement and remote code execution by spawning unauthorized processes on target systems.

Adversaries, including operators of Remcos and njRAT, utilize the Regsvr32 utility with silent and install parameters to load malicious DLLs for code execution and persistence.

Detection of malicious actors using the curl utility on Linux systems to download remote scripts or binaries via common command-line flags.

Detection of attackers using base64 decoding utilities coupled with pipe redirection to Linux shells to execute obfuscated malicious payloads.

The TeamTNT threat group leverages the curl utility to exfiltrate sensitive AWS credential and configuration files to remote attacker-controlled servers.

Adversaries leverage the Linux xclip command-line utility to intercept or exfiltrate sensitive information stored in the system clipboard.

Detection of adversaries utilizing the 'xclip' utility on Linux systems to exfiltrate sensitive information stored in the system clipboard.

Adversaries leverage the Impacket wmiexec.py tool to facilitate lateral movement and remote code execution by spawning processes via wmiprvse.exe using distinct command-line obfuscation and hidden share access patterns.

Attackers utilize the legitimate Windows utility esentutl.exe to perform unauthorized copies of the SAM and ntds.dit files for offline credential extraction, facilitating privilege escalation and lateral movement.

Adversaries leverage the legitimate comsvcs.dll library to dump the LSASS process memory via rundll32.exe, enabling unauthorized credential extraction from Windows systems.

Attackers abuse the trusted Microsoft Regsvr32 utility to proxy malicious code execution via 'scrobj.dll', a technique commonly known as 'Squiblydoo' used to bypass application control.

The execution of PsExec with the 'accepteula' flag is a common indicator of unauthorized remote code execution and lateral movement activity by threat actors.

Attackers abuse the Microsoft HTML Help utility (hh.exe) to execute arbitrary code or scripts by loading malicious Compiled HTML Help (CHM) files via InfoTech Storage Handlers.

Threat actors leverage native administrative tools such as WMIC and PowerShell to create Volume Shadow Copies, a technique used to facilitate credential dumping and offline password cracking.

Adversaries frequently abuse the legitimate Windows CertUtil utility to decode obfuscated malicious payloads, facilitating defense evasion and subsequent unauthorized code execution.

Attackers abuse the legitimate BITSAdmin utility to download and execute malicious payloads via the Background Intelligent Transfer Service, facilitating various post-exploitation activities.

Adversaries leverage the Windows Background Intelligent Transfer Service (BITS) utility bitsadmin.exe to establish persistence, download malicious payloads, or exfiltrate data by creating and scheduling jobs.

Detection of the Microsoft HTML Help executable (hh.exe) spawning child processes, which indicates the potential use of malicious Compiled HTML Help (CHM) files to execute arbitrary scripts and bypass security controls.

Attackers are abusing Windows SSH configuration features 'ProxyCommand' and 'LocalCommand' to execute arbitrary scripts and establish command-and-control channels via living-off-the-land binaries.

CVE-2026-96940 is an elevation of privilege vulnerability in Microsoft Exchange Server that allows authenticated attackers to escalate privileges within the server environment.

Attackers can exploit custom or native Windows protocol handlers to execute arbitrary commands, maintain persistence, or escalate privileges by abusing URI-based application launching.

Adversaries attempt to evade security controls by renaming standard Windows command interpreters like cmd.exe or powershell.exe to masquerade as benign files.

Adversaries frequently repurpose legitimate NirSoft administrative utilities for credential theft, reconnaissance, and system monitoring on Windows endpoints.

This detection targets threat actors attempting to evade security defenses by renaming native Windows binaries to circumvent signature-based detection or security policy enforcement.

This brief identifies the abuse of the Windows Installer process, msiexec.exe, by adversaries to establish persistence via scheduled tasks, startup folders, and registry autorun keys.

Detection of potentially unauthorized process execution using the Microsoft-signed Windows Performance Toolkit utility XBootMgrSleep.exe to bypass security controls.

Adversaries leverage legitimate Microsoft Defender Antivirus exclusion settings via PowerShell, WMI, and GPO to bypass real-time scanning and hide malicious payloads from endpoint detection.

Attackers with unauthorized access to a CrowdStrike management console can leverage the 'runscript' functionality to execute arbitrary PowerShell commands on remote Windows hosts.

Attackers can abuse sideloaded AppX packages and the legitimate WWAHost.exe binary to trigger a genuine Microsoft OAuth login flow, capturing valid authentication tokens without traditional phishing indicators.

AI coding assistants including OpenClaw, Moltbot, and Clawdbot are being weaponized via malicious 'ClawHub' registry skills to execute unauthorized system commands and exfiltrate cryptocurrency and credential data.

Adversaries are abusing the AWS Systems Manager SendCommand API to remotely execute commands on EC2 instances by leveraging legitimate system utilities (LOLBins) to bypass CloudTrail parameter redaction.

Threat actors, including Rhysida and Storm-0501, abuse native Microsoft Azure storage utilities as living-off-the-land binaries to exfiltrate data from compromised endpoints to attacker-controlled cloud storage.

Adversaries often execute 'crontab -l' to enumerate existing scheduled tasks, enabling the discovery of persistence mechanisms, legitimate job hijacking targets, or privilege escalation opportunities.

Adversaries frequently leverage the C# compiler (csc.exe) to compile malicious code on-the-fly, often triggered by suspicious parent processes such as office applications or script engines.

Adversaries leverage the signed Windows binary mavinject.exe to perform unauthorized process injection by executing DLLs into running system processes.

Adversaries leverage the native .NET InstallUtil.exe utility with specific flags to execute arbitrary code while bypassing standard logging and console output mechanisms.

Adversaries leverage the native Windows utility InfDefaultInstall.exe to execute malicious script content embedded within specially crafted INF files.

This rule identifies the use of the '<' operator with cmd.exe to read content from files or streams, a technique often used by attackers to bypass execution policy restrictions or bypass basic file-based detection.

Adversaries leverage the MSXML2 COM object within PowerShell scripts to facilitate network communication and potential code execution.

This brief documents a detection method for identifying potentially malicious PowerShell scripts that decode base64-encoded Gzip archives to facilitate in-memory code execution.

Adversaries often abuse legitimate remote access software like GoToAssist to establish interactive command-and-control channels, leaving specific temporary artifacts in the user's local profile.

Adversaries frequently utilize script interpreters such as cscript, wscript, and mshta from non-standard or user-writable directories to execute malicious payloads while evading security controls.

Adversaries are utilizing the native Windows script GatherNetworkInfo.vbs to perform system reconnaissance and collect network configuration data.

Adversaries are leveraging legitimate Windows command-line tools such as PowerShell, curl, and wget to collect system information and exfiltrate data via HTTP POST requests.

Adversaries may rename the legitimate createdump.exe utility to evade detection while performing unauthorized process memory dumps for credential access.

Detection of attackers using the Windows mshta.exe utility to execute malicious JavaScript code for living-off-the-land stealth execution.

Adversaries utilize the legitimate Windows mshta.exe utility to execute remote malicious HTA files, bypassing security controls by fetching code directly from web-based infrastructure.

Adversaries utilize the Windows mklink utility to create symbolic links to Volume Shadow Copies, enabling unauthorized access to sensitive files like the SAM database for credential theft.

This brief documents detection logic for identifying potential malicious file downloads and C2 communication using native Windows command-line tools and PowerShell cmdlets.

Adversaries frequently abuse native Windows utilities like vssadmin and wmic to create volume shadow copies, a precursor to offline credential theft via NTDS.dit extraction.

Adversaries may execute malicious payloads by leveraging rundll32.exe with non-standard file extensions to bypass simple filename-based security controls.

Adversaries utilize the Python '-c' flag to execute arbitrary code or payloads directly from the command line, bypassing file-based execution triggers.

Attackers can leverage the legitimate Windows print.exe utility to perform unauthorized remote file copying, facilitating data staging and exfiltration.

This brief details a detection strategy for identifying PowerShell command-line activity associated with common file download patterns used by various threat actors.

Adversaries leverage the Windows Installer service (msiexec.exe) to download and execute malicious MSI packages directly from remote web URLs to facilitate stage-two payload delivery.

Attackers can leverage the findstr.exe utility to download or read content from remote SMB shares using specific command-line arguments, potentially facilitating file exfiltration or second-stage payload delivery.

Detection of suspicious network activity where Windows script interpreters (Wscript.exe and Cscript.exe) initiate connections to local IP ranges.

Adversaries utilize Windows script engines, wscript.exe and cscript.exe, to initiate outbound network connections for downloading malicious payloads or communicating with command and control infrastructure.

Adversaries utilize the native Windows 'arp.exe' utility to perform network reconnaissance, mapping active hosts to facilitate lateral movement within compromised environments.

Adversaries frequently abuse the legitimate curl command-line utility to exfiltrate collected sensitive data to external Command and Control (C2) servers via network protocols.

Adversaries leverage the Windows Installer utility msiexec.exe to proxy the quiet execution of malicious payloads, bypassing traditional security controls by masquerading as legitimate installation processes.

This brief details the abuse of the Windows utility msiexec.exe by attackers to download and execute remote files via HTTP or HTTPS URLs, often leading to unauthorized code execution, system compromise, or further malware deployment.

This threat brief details the detection of adversaries leveraging the legitimate Windows Background Intelligent Transfer Service (BITSAdmin) utility to download malicious payloads from suspicious file-sharing and cloud storage domains, a technique commonly employed by ransomware groups and APTs for ingress tool transfer and stealthy execution.

Adversaries leverage the native Windows Management Instrumentation Command-line (WMIC) utility to terminate applications, specifically security products, as a defense evasion technique.

A high-severity threat involves adversaries abusing `wmic.exe` to create new processes like `rundll32` or `powershell` on Windows systems, a technique observed in ransomware campaigns such as Ryuk, Hive, and Conti, indicating post-compromise execution.

Threat actor Volt Typhoon is observed using the built-in Windows Management Instrumentation Command-line (WMIC.EXE) utility to perform system and volume discovery, gathering critical system information that can facilitate further network exploitation and data exfiltration.

Unidentified threat actors may leverage the legitimate Microsoft Sysinternals PsSuspend utility to suspend critical processes on Windows systems, enabling evasion of security controls or disruption of operations.

The execution of a renamed Microsoft Sysinternals Sdelete utility is a highly suspicious technique often employed by adversaries to destroy data on Windows systems, leading to severe impact on system integrity and data availability.

This brief describes the detection of Living Off The Land Binaries (LOLBINs) and legitimate Windows applications being abused to drop various script files to disk, indicating malware staging or script-based code execution attempts.

This brief details a detection method for identifying malicious activity where legitimate Windows applications, including Living-Off-The-Land Binaries (LOLBINs) and common productivity software, are abused to drop executable files onto the disk, often indicating malware staging, persistence mechanisms, or process injection attempts.

An unknown threat actor gained continuous administrative access to a senior finance executive's Microsoft Outlook mailbox at a global stock exchange for at least five months, deploying custom infostealers via scheduled tasks and exfiltrating sensitive emails through a Dropbox-based command and control channel after an initial lateral movement event.

This correlation search identifies multiple risk events associated with 'Living Off The Land' activity, leveraging the Risk data model to aggregate events, focusing on systems with a high count of distinct sources, potentially enabling attackers to execute code, escalate privileges, or persist within the environment using trusted system utilities.

Detection of PowerShell execution initiated via Crowdstrike Real Time Response (RTR) 'runscript' command, potentially indicating malicious actors leveraging compromised Crowdstrike Dashboard access to execute commands on remote hosts using encoded commands.

The analytic identifies instances where wmiprvse.exe spawns msbuild.exe, an unusual process relationship indicative of potential COM object misuse and unauthorized code execution on Windows systems.

Attackers are abusing the Windows Defender command-line utility, MpCmdRun.exe, to download malicious files from remote URLs, enabling them to introduce malware or offensive tooling into compromised environments.

Detection of msbuild.exe execution from a non-standard path, indicating potential attempts to evade detection and execute malicious code.

The use of Microsoft Workflow Compiler (microsoft.workflow.compiler.exe), a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319, can indicate malicious intent such as code execution or persistence mechanisms, potentially leading to unauthorized access.

Detection of the renaming of microsoft.workflow.compiler.exe, a technique used by attackers to evade security controls and potentially execute arbitrary code for privilege escalation or persistence.

Detection of regasm.exe spawning a child process, an unusual behavior that may indicate attempts to bypass application control and execute arbitrary code.

Detection of netsh.exe execution by unusual processes indicative of potential malicious activity, including persistence and network configuration changes by threat actors.