haadi@portfolio:~$ cat living-off-the-land-attacks.md
Room notes · SOC Level 1 · Malware concepts for SOC
Living Off the LandAttacks
Living Off the Land (LoL) attacks: how threat actors use legitimate, built-in Windows tools to perform malicious actions without deploying custom malware: and how SOC analysts detect them.
What This Room Covers
Living Off the Land (LoL) attacks: how threat actors use legitimate, built-in Windows tools to perform malicious actions without deploying custom malware, and how SOC analysts detect them.
Key Concepts Learned
What is Living Off the Land? Instead of deploying custom malware (which can be detected by AV/EDR), attackers use tools already present on the target:
- PowerShell, cmd.exe, WMI, certutil, bitsadmin, mshta, regsvr32, rundll32
- These are signed by Microsoft, trusted by AV, and have legitimate uses
The challenge: these tools appear in normal Windows environments. Detection requires behavioral context: who ran it, from which parent process, doing what, at what time.
Key LoL Tools and Their Abuse
| Tool | Legitimate Use | Attacker Abuse |
|---|---|---|
| PowerShell | Administration and scripting | Payload download (IEX), in-memory execution, C2 communication |
| certutil | Certificate management | File download (-urlcache -split -f), base64 decode |
| bitsadmin | Background file transfer | Download payloads via BITS jobs |
| wmic | Hardware/software inventory | Remote process creation, reconnaissance |
| mshta | Run HTA applications | Execute malicious scripts from URL |
| regsvr32 | Register COM objects | Execute malicious DLLs or scripts remotely |
LOLBAS and GTFOBins: reference databases
- LOLBAS (lolbas-project.github.io): Windows binaries that can be abused
- GTFOBins (gtfobins.github.io): Unix/Linux binaries that can be abused
Both are essential references for both attackers and defenders. SOC analysts use them to understand what a flagged binary could be used for.
WMI Event Subscriptions: one of the most durable persistence methods WMI (Windows Management Instrumentation) can be configured to run a command when specific system events occur. Attackers abuse this (MITRE T1546.003) to execute malware on startup, at login, or at regular intervals: entirely using built-in Windows functionality.
Detection strategy: behavior over signature LoL attacks cannot be detected by checking if a tool is malicious (it is legitimate). Detection requires:
- Monitoring command-line arguments of known LoL tools
- Detecting parent-child process anomalies (Word spawning PowerShell)
- Checking execution context (PowerShell running encoded commands at 3 AM)
- Correlating with network connections immediately after LoL tool execution
Task Answers
| Question | Answer |
|---|---|
| Public site listing Linux/Unix abusable binaries | GTFOBins |
| Microsoft toolset including PsExec and Autoruns | Sysinternals |
| MITRE technique ID for WMI event subscriptions | T1546.003 |
| Service C2s like Cobalt Strike use for remote services | SMB |
| PowerShell switch used to download and execute text/strings | IEX |
| WMIC keyword to create a process on remote host | create |
| Final flag | THM{LOL-but-not-that-lol-you-finishit} |
Key Concepts for SOC Work
PowerShell with IEX (Invoke-Expression) + encoded command is a red flag. powershell -enc <base64> or IEX(New-Object Net.WebClient).DownloadString('http://...') are the most common PowerShell download-and-execute patterns. A Sysmon rule alerting on PowerShell process creation with -enc or IEX in the command line is one of the highest-value, lowest-effort detections a SOC can implement.
LoL attacks are what Windows Threat Detection 2 was training for. The download techniques (curl.exe, certutil.exe, PowerShell IWR) practiced in that room are all LoL techniques. This room connects the detection-focused work to the broader framework of why these specific tools matter.
Originally published on GitHub
view-source