Detection: Windows LOLBin Binary in Non Standard Path

Description

The following analytic identifies native living off the land binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe, explorer.exe, csc.exe, hh.exe, regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.

Annotations

No annotations available.

Implementation

Collect endpoint data such as sysmon or 4688 events.

Known False Positives

False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.

Associated Analytic Story

• Unusual Processes

• Ransomware

• WhisperGate

Risk Based Analytics (RBA)

References

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml

• https://attack.mitre.org/techniques/T1036/003/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md

Version: 8