Living off the land (LOLBins)

Operating systems ship with a large set of signed utilities capable of downloading files, executing code, encoding data, creating scheduled tasks, querying the directory and reading credential stores. An operator who uses those instead of their own tooling introduces nothing to scan and no unsigned process, which is why it is the backbone of practical EDR evasion. The same applies to the administrative tools the estate already trusts: remote management agents, deployment platforms, backup software and monitoring tools all execute arbitrary commands on many hosts by design.

Curated public catalogues document which shipped binaries can be abused and how, for Windows and for Unix-like systems, which means the technique requires no research.

Detection built around identifying malicious files has nothing to identify, and detection built around unsigned or unusual processes sees a signed system utility used a thousand times a day for legitimate reasons. The only durable signal is context: which parent process launched it, with which arguments, on which host, by which user, and whether that combination has ever happened before in this estate.

That is a genuinely hard detection engineering problem, because it requires command line telemetry, a behavioural baseline of the specific environment, and rules that can distinguish an administrator’s normal work from the same action performed by somebody else. Blocking the binaries is rarely available: they exist because the operating system and the estate’s own automation need them.

The related failure is a rule written against a tool name. Matching a well-known credential utility by filename is defeated by renaming it; matching the way it accesses the credential store is not, which is exactly the difference between signature thinking and behavioural thinking. Combined with in-memory execution, an operation can leave almost nothing on disk.

This is the technique that produces the most uncomfortable and most useful result in a red team exercise, because clients with substantial investment in endpoint tooling frequently discover that an operator who brings nothing is not seen at all. We record each utility used, the exact command line and the time, and hand that back so the client can search their telemetry and establish whether the data even existed. The finding is usually missing command line logging rather than a missing rule. This is part of how we test detection against an operator who brings no tools.