Living off the land: Attackers leverage legitimate tools for malicious ends

guest · Dec 24, 2019

Living off the land: Attackers leverage legitimate tools for malicious ends
Living-off-the-land techniques remain popular
December 24, 2019
https://www.symantec.com/blogs/threat-intelligence/living-land-legitimate-tools-malicious

Symantec has previously published research that gives a general overview of living-off-the-land tactics and fileless attack techniques; however, our new research provides updated statistics on the dual-use tools utilized in these attacks—with a focus on PowerShell and Windows Management Instrumentation (WMI)—and how they are currently being used by different attack groups.
Malicious or benign?
The most frequently executed tools observed by Symantec in Q1 2019 were net.exe, PowerShell, the certification utility, the task scheduler, and the WMI command line (WMIC). However, only a fraction of the overall usage of these tools was malicious.

We also looked at more than 500,000 dual-use tool detections from the beginning of September 2019, which were either used to download or copy payloads to target computers. This revealed that WMI, the command line tool, and PowerShell were most frequently used for malicious purposes, accounting for 89 percent of all dual-use tools used as downloaders.
Click to expand...

Targeted attack groups
Looking at six active targeted attack groups and the living-off-the-land tools they use reveals that PowerShell is by far the most popular, with all six utilizing it in their attacks. In all, around 77 percent of targeted attack incidents made use of PowerShell. The credential-dumping tool Mimikatz, used by four of the groups, is the second most popular tool.
Click to expand...

New research (2019):
White Paper: "Living off the Land - Turning Your Infrastructure Against You" (PDF - 1.28 MB):
https://www.symantec.com/content/dam/symantec/docs/white-papers/living-off-the-land-turning-your-infrastructure-against-you-en.pdf

Previous research (2017):
White Paper: "Living off the land and fileless attack techniques - An ISTR Special Report" (PDF - 524 KB):
https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf

Rasheed187 · Dec 26, 2019

Cool, nice report. It's good to see that most of these attacks can be stopped by simply monitoring process execution. Here is a list of the so called LOLBins that are often used in these attacks: https://lolbas-project.github.io

Log in or Sign up

Living off the land: Attackers leverage legitimate tools for malicious ends

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Living off the land: Attackers leverage legitimate tools for malicious ends

guest Guest

Rasheed187 Registered Member

Useful Searches