Lotl

Attackers are abusing the legitimate Windows utility odbcconf.exe to execute arbitrary code or load malicious DLLs by utilizing response files to bypass security controls.

Attackers can bypass application whitelisting policies by leveraging rundll32.exe to execute arbitrary code through specific Windows library functions, facilitating persistence and privilege escalation.

Adversaries modify SSH authorized_keys files on Linux systems to establish persistent access and bypass authentication, a technique detectable through process execution monitoring.

Adversaries leverage the Linux base64 utility to deobfuscate malicious payloads and scripts, a common tactic for evading static analysis and security controls during the execution phase.

Attackers abuse the legitimate Windows mshta.exe utility to execute malicious scripts via inline protocol handlers to bypass security controls and achieve code execution.

Threat actors leverage native administrative tools such as WMIC and PowerShell to create Volume Shadow Copies, a technique used to facilitate credential dumping and offline password cracking.

This analytic identifies potential DLL sideloading or search order hijacking by monitoring for the loading of known abuse-prone DLLs from non-standard directory paths on Windows endpoints.

Adversaries may abuse the native 'osascript' utility on macOS to establish long-lived command-and-control channels or remote network connections, which can be identified by analyzing flow duration metadata.

Adversaries leverage 'for /f' loops within 'cmd.exe' to programmatically extract and process data from system command outputs for discovery and post-exploitation tasks.

Adversaries gaining unauthorized workflow trigger access can abuse GitHub Actions runners to execute arbitrary system commands, potentially leading to credential harvesting, reconnaissance, and CI/CD supply chain compromise.

Adversaries are utilizing the native Windows script GatherNetworkInfo.vbs to perform system reconnaissance and collect network configuration data.

Adversaries are leveraging the legitimate Windows binary 'esentutl.exe' to bypass file locks and perform unauthorized copies of system credential databases such as NTDS.dit and SAM.

Adversaries are increasingly targeting macOS environments, leveraging native tools like Remote Application Scripting (RAS) and Spotlight metadata to bypass security controls for remote code execution and lateral movement.

Adversaries are increasingly targeting macOS environments, leveraging native tools like Remote Application Scripting (RAS) and Spotlight metadata to bypass security controls for remote code execution and lateral movement.