How to Detect Malicious Use of Living-Off-the-Land Binaries

Summary

Huntress outlines ways to detect malicious use of native system tools, including comparing activity with organizational baselines and checking process ancestry, account conventions, and command-line patterns.

Key points

LOLBins are legitimate, pre-installed operating-system tools that attackers may abuse for reconnaissance, privilege escalation, lateral movement, persistence, or data exfiltration.
Detection depends on establishing which users and endpoints normally run tools such as net.exe, and how they use them.
Unexpected net.exe account-management commands, including arguments such as user, localgroup, or add, warrant investigation against the organization’s baseline.
Process ancestry can provide context: the article flags commands launched by wmiprvse.exe, PsExec.exe, or sqlservr.exe as suspicious.
Misspelled or unconventional usernames and account names that violate organizational naming conventions can be warning signs.
Huntress analysts report observing unusual net.exe command syntax and recurring usernames and passwords across customer cases; these examples are indicators to investigate, not proof by themselves.

Article Details

Defense Focus: Detect malicious use of legitimate system binaries by comparing activity with organizational baselines for users, endpoints, command lines, and process ancestry.
Detection Methods: Baseline which administrators normally use net.exe, from which endpoints and accounts, and for what account-management tasks; investigate activity outside those patterns.
Alert on net.exe command lines containing arguments such as user, localgroup, or add when that use is not part of normal operations.
Inspect process ancestry for commands launched with wmiprvse.exe, PSExec.exe, or sqlservr.exe as the parent or grandparent.
Compare newly created usernames and observed command-line conventions with organizational standards; investigate misspellings and non-standard command syntax.
Look for repeated suspicious passwords and account names mentioned in the article, including Ujmqaz5055 and Adminstrator.
Data Sources: Endpoint process execution records, including command lines and parent/grandparent process names
User-account creation and management activity
Endpoint, administrator, and account baselines
Rule Types: Behavioral detections based on deviations from normal user, endpoint, and account-management activity
Command-line pattern detections for net.exe account-management arguments and unusual argument ordering
Process-ancestry detections
Platforms: Windows endpoints
Defensive Actions: Establish and maintain baselines for legitimate use of native utilities, including who uses them, from which endpoints, and with which accounts.
Investigate net.exe activity and process ancestry that fall outside established administrative patterns.
Review newly created accounts for departures from organizational username conventions and suspicious command syntax.
Use endpoint protection and monitoring to identify and disrupt anomalous native-utility activity.