Why Hunting For LOLBINs Is One Of The Best Bets

Living of the Land — Photo by no one cares on Unsplash

Introduction

While working on “Malicious Command-Line”(MAL-CL), documenting and researching the many use cases different tools can be (ab)used via the command line. I noticed a trend that in hindsight seems “obviously obvious” but is I believe worth saying nonetheless.

You don’t drop things just because they’re old and dusty, you drop them only when they stop working

And by things that “work” I mean of course our beloved LOLBINs.

LOLBINs are in some way like shiny pokemon in the sense that once you catch one you need to brag about it by using it all the time.

Now, we might talk about the latest C2 framework and how it’ll offer command line obfuscation, parent/child spoofing, EDR unhooking, Direct Syscal invokes, and some other shenanigans that I’m not even aware of and while there is a thread of truth in those statements and attackers are certainly using these “advanced” techniques. The fact of the matter is attacks happen in a chain and in this chain often time than not LOLBINs are a big part of it.

Note: This blog post is in no capacity saying you should stop hunting for other stuff or hunt for X or Y. I’m simply pointing out a statistical observation that infer that “simple != bad” necessarily

What do the Numbers Say

Threat reports are a good reference to see attacker tradecraft in the wild, so let’s take a look at a couple of them.

A great report to look at first is the “Red Canary’s Threat Detection Report”. You should definitely check the whole report as it’s an amazing read. I’m going to simplify some things to fit the context of the blog

TOP 10 Techniques — Red Canary Threat Detection Report

If we take a look at the top four techniques from this top 10 and check the most prevalent sub-techniques in each category we’ll get the following:

  • T1059.001 — PowerShell
  • T1059.003 — Windows Command Shell
  • T1218.011 — Rundll32
  • T1218.005 — Mshta
  • T1543.003 — Windows Service
  • T1053.005 — Scheduled Task

Most of these sub-techniques were achieved via the use of pre-installed binaries such: “schtasks”, “sc”, “powershell.exe”, “cmd.exe”, “rundll32”, “mshta”…etc.

This is not to say other techniques nor tools were used but as i’m stating from the start there are always LOLBINs at play.

Another interesting result form Kaspersky MDR team, where they released a blog post titled “Cybercriminals’ top LOLBins” where two of the most used LOLBINs were “PowerShell” as it was used in 1 in 5 “Critical Incident” and “rundll32”.

expel has also shared their annual report titled “Great eXpeltations 2022” where they shared data from their SOC and its a fantastic read. But to grab one thing from their report that fits our context here is the highlighted “Top Windows processes to monitor” which most of them are “conveniently” LOLBINs

  • PowerShell
  • CMD shell
  • Wscript.exe
  • RegSvr32.exe
  • W3wp.exe

Even the term “lolbins” is still seeing a jump every year in the trends and even with nothing else this does signify something…I hope.

https://trends.google.com/trends/explore?date=today%205-y&q=lolbins

I could highlight this point even further with more examples from different threat reports but I think looking at real and “infamous” case studies we’ll make the point even clearer.

Case Studies

Below are simply some of the tools and command-line usage seen in this “infmaous” attacks

Wannacry (2017)

Source: WannaCry Malware Profile

icacls . /grant Everyone:F /T /C /Qattrib +h +s <Drive_Letter>:\$RECYCLEtaskkill.exe /f /im sqlserver.exetaskkill.exe /f /im sqlwriter.exetaskkill.exe /f /im mysqld.execmd.exe /c start /b @WanaDecryptor@.exe vsvssadmin delete shadows /all /quietwmic shadowcopy deletebcdedit /set {default} bootstatuspolicy ignoreallfailuresbcdedit /set {default} recoveryenabled nowbadmin delete catalog -qcscript.exe //nologo <1 character>.vbs

Solarwinds (2020)

Source: Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop

wmic /node:[target] process call create “rundll32 c:\windows\[folder]\[beacon].dll [export]”Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\Windows\[folder]\[beacon].dll [export]’ -ComputerName [target]rundll32.exe c:\windows\[folder]\[beacon].dll [export]netsh advfirewall firewall add rule name=”[rulename1]” protocol=UDP dir=out localport=137 action=blockschtasks /query /v /s [target] /fo csvsc \\[target] query type=service state=allwmic /node:”[target]” service get name,startnamereg add HKLM\system\currentcontrolset\services\[service name] /v Start /t REG_DWORD /d 4″

Conti Leak (2021)

Source: Conti Manual Leak

whoami /groupsnet localgroup administratorsnltest /dclist:[domain]rundll32.exe C:\windows\System32\comsvcs.dll,MiniDump PID C:\ProgramData\lsass.dmp fullwmic /node: {1} process call create "rundll32.exe C:\ProgramData\2.dll StartW"wmic /node:"DC01" /user:"DOMAIN\admin" /password:"cleartextpass" process call create "cmd / c vssadmin list shadows >> c: \log.txt"powershell Set-MpPreference -DisableRealtimeMonitoring $truereg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v oldadministrator /t REG_DWORD /d 0 / f

Moonbounce (2022)

Source: MoonBounce: the dark side of UEFI firmware

net  start "iscsiwmi"sc  stop iscsiwmisc  delete iscsiwmireg  add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost" /v "iscsiwmi" /t REG_MULTI_SZ /d "iscsiwmi" /fsc  create "iscsiwmi" binPath= "$system32\svchost.exe -k iscsiwmi" type= share start= auto error= ignore DisplayName= "iscsiwmi"SC  failure "iscsiwmi" reset= 86400 actions= restart/60000/restart/60000/restart/60000sc  description "iscsiwmi" ""iSCSI WMI Classes That Manage Initiators, Ports, Sessions and Connections""reg  add "HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters" /freg  add "HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters" /v "ServiceDll" /t REG_EXPAND_SZ /d "$windir\Microsoft.NET\Framework64\v4.0.30319\System.Mail.Service.dll" /fnet  start "iscsiwmi"

No matter the sophistication of the attacker weather be it a supply chain or a UEFI implant at some point in the attack chain LOLBINs “will” be used.

Hunting & Detecting LOLBINs Usage

Whilst the experience of detecting LOLbin’s could and will be different from one company to another (after all these are system binaries or admin utilities getting abused). There are common guidelines that can help.

Keeping Up With The Trends

“You can’t defend what you don’t know” — This mean that if you’re not aware that “certutil” can be abused as a downloader you can’t detect its usage.

Now if you’re one of those who are saying: “No…Don’t focus on the tool focus on the behaviour” know that this article is not aim for you as you’re already ahead of most. So let’s keep it simple for the sake of the blog.

To keep up with the latest LOLBINs in town fortunalty there are a couple of ways:

  • LOLBAS-Project
  • Infosec twitter and hashtags such as #lolbin
  • Projects like MAL-CL that keeps track of how command line utitilites can be “abused”

Baseline and AppControl

In the case where you’re already aware of what’s out there and wondering how can I detect this. Stop and try to block it first instead.

Using stuff like WDAC from Microsoft or something like Symantec’s Adaptive Protection will help you baseline and block the stuff that you don’t use. See link below as an example.

Log, Collect and Detect

There are some LOLBINs that you can’t do a lot about and in those case detection will come to our help. Having something like command-line logging enabled and Sysmon logging is ver helpful to find these kind of stuff.

SIGMA is a great resource along with others to find detections about these LOLBINs

Conclusion

As a conclusion, the idea of focusing on LOLBINs might be a controversial one to some. But as I stated multiple times, this blog is here to highlight the importance of LOLBINs in attackers tradecraft and why its shouldn’t be ignored.

As always following a structure like the Pyramid of Pain in your hunting logic, priority and coverage is always a great choice but if you don’t have the necessary resources and your hesitating between behaviour and LOLBINs, I say go for LOLBINs first.

I hope you found the information here useful and helpful. If you want discuss this or anything infosec related you can find me on twitter @nas_bench

--

--

--

I write about #ThreatHunting #WindowsInternals #Malware #DFIR and occasionally #Python.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

{UPDATE} Dream of Weed Slot Machines – Free Slots & Casino Hack Free Resources Generator

Tutorial: How To Claim HOS-IDO Tokens Using MetaMask Desktop Version

{UPDATE} BridgeAssistant Hack Free Resources Generator

Photo from @zanilic for making this photo available freely on unsplash

Cybersecurity Weekly Issue 11

Announcement: Deployment of HOS and HOR on Binance Smart Chain (BSC)

Bypassing OTP verification

This week in Dapps - Ep.53 is here! 🎉

Get the Medium app

Nasreddine Bencherchali

Nasreddine Bencherchali

I write about #ThreatHunting #WindowsInternals #Malware #DFIR and occasionally #Python.

More from Medium

PowerShell Empire — Threat Hunting with Splunk

LOLBINed — 360TotalSecurity (360AdvToolExecutor.exe)

Incident Response Extraction Script (IRES) — Phase 1: Documentation.

Creating Malicious .wms Files — Malware Mondays #3