Living off the Land techniques allow attackers to use native Windows binaries,
scripts, and libraries to facilitate different stages of the attack lifecycle.
In other words, instead of introducing their own tools,
attackers simply use the built‑in Windows binaries.
In this clip,
I'm going to talk about how we can leverage Winlogbeat to
detect Living off the Land attacks.
Let's say we're in a relatively new environment and we decide
to whitelist all Microsoft signed binaries in an attempt to
curb malicious software execution.
Well, that's still not a bad practice; however,
now the adversary uses those same trusted binaries to
perform their post‑exploitation activities.
It all started with binaries like bitsadmin,
which can be used to download additional resources for an attack,
and MSBuild, which can be used to compile and execute code.
These two binaries together will allow an attacker to download their
source code and then build and execute their custom code,
all with a high chance of evading detection.
Collectively, the Living off the Land binaries are called LOLBins.
Then, the security community found Microsoft signed scripts could be
used maliciously, and thus, LOLBAS, or Living off the Land Binaries
and Scripts, was born. Security researchers later demonstrated that
native libraries like shell32.dll could be used for a proxy execution
of arbitrary code,
but the name of the project wasn't changed. So,
LOLBAS implicitly refers to libraries.
If I open a command interpreter on a Windows system,
which I will sometimes refer to as the CLI, the programs or
processes I start manually or programmatically are not logged by
default; however, we can enable Windows event ID 4688, which is
generated every time a new process starts.
Event ID 4688 can generate a lot of events in some
environments; however, one tradeoff is to enable the event ID
only on critical or high‑value systems.
Another step that could be helpful is to enable command line
login, which will give you the command line arguments and any
parameters used when a process is launched.
I want to clarify something here.
You don't have to run the program from the CLI or manually typed commands.
Any process or program that runs on the system will likely
generate a 4688 event; therefore, we should develop a
baseline and conduct careful filtering.
So how do we go about enabling this event ID? I recommend using a GPO so you
can scale or scope the effects of this configuration. Log on to your domain
controller, and using the Group Policy Management Editor, you need to change
Audit Process Creation to at least Success.
This setting is found under Policies, Windows Settings,
Security Settings,
Advanced Audit Policy Configuration, Audit Policies, and Detailed Tracking.
We could stop there, but we should configure command line login and either
use a new GPO or modify the previous. Here, we need to change the Include
command line and process creation events to enable found under Policies,
Admin Templates, System, Audit Process Creation. Once you have correctly
applied the GPOs, Winlogbeat will pick up event ID 4688 and ship it to our
Elasticsearch cluster.
So how do we take all of this information and turn it into
detection of Living off the Land attacks?
The naive approach is to just search for the 100+ LOLBAS
files and then investigate each log event.
A better approach is to first determine what is normal for your environment.
At the bare minimum, you should have good observation of the
LOLBAS list and how it relates to your environment.
Then, block execution of the binaries,
scripts or libraries you do not need or use. For example, is
MSBuild routinely executed? What about certutil?
Once you have that baseline, then we need to look at context.
The LOLBin certutil, which is a command line utility
used for handling certificates,
can also be used to download files, so if I have
certutil executed in my environment daily,
weekly,
monthly, etc, does it use the following command line parameters? What
about the arguments? If not, then create your alert conditions around
what is anomalous for your environment.
Another mistake is to focus too much on the LOLBAS names.
If I rename certutil.exe to notevil.exe, it will still maintain its
cryptographic signature, which means it will escape searches for certutil.exe.
Attackers know this and won't always use the default names.
The last thing I'll mention here is to be cautious when it comes to
case sensitivity and searching your dataset. Attackers will try to
avoid detection by mixing upper and lowercase letters in the LOLBAS
names and associated arguments.
That's it for this clip.
Thanks for watching.