Introduction
While working on “Malicious Command-Line”(MAL-CL), documenting and researching the many use cases different tools can be (ab)used via the command line. I noticed a trend that in hindsight seems “obviously obvious” but is I believe worth saying nonetheless.
You don’t drop things just because they’re old and dusty, you drop them only when they stop working
And by things that “work” I mean of course our beloved LOLBINs.
LOLBINs are in some way like shiny pokemon in the sense that once you catch one you need to brag about it by using it all the time.
Now, we might talk about the latest C2 framework and how it’ll offer command line obfuscation, parent/child spoofing, EDR unhooking, Direct Syscal invokes, and some other shenanigans that I’m not even aware of and while there is a thread of truth in those statements and attackers are certainly using these “advanced” techniques. The fact of the matter is attacks happen in a chain and in this chain often time than not LOLBINs are a big part of it.
Note: This blog post is in no capacity saying you should stop hunting for other stuff or hunt for X or Y. I’m simply pointing out a statistical observation that infer that “simple != bad” necessarily
What do the Numbers Say
Threat reports are a good reference to see attacker tradecraft in the wild, so let’s take a look at a couple of them.
A great report to look at first is the “Red Canary’s Threat Detection Report”. You should definitely check the whole report as it’s an amazing read. I’m going to simplify some things to fit the context of the blog
TOP 10 Techniques — Red Canary Threat Detection ReportIf we take a look at the top four techniques from this top 10 and check the most prevalent sub-techniques in each category we’ll get the following:
- T1059.001 — PowerShell
- T1059.003 — Windows Command Shell
- T1218.011 — Rundll32
- T1218.005 — Mshta
- T1543.003 — Windows Service
- T1053.005 — Scheduled Task
Most of these sub-techniques were achieved via the use of pre-installed binaries such: “schtasks”, “sc”, “powershell.exe”, “cmd.exe”, “rundll32”, “mshta”…etc.
This is not to say other techniques nor tools were used but as i’m stating from the start there are always LOLBINs at play.
Another interesting result form Kaspersky MDR team, where they released a blog post titled “Cybercriminals’ top LOLBins” where two of the most used LOLBINs were “PowerShell” as it was used in 1 in 5 “Critical Incident” and “rundll32”.
expel has also shared their annual report titled “Great eXpeltations 2022” where they shared data from their SOC and its a fantastic read. But to grab one thing from their report that fits our context here is the highlighted “Top Windows processes to monitor” which most of them are “conveniently” LOLBINs
- PowerShell
- CMD shell
- Wscript.exe
- RegSvr32.exe
- W3wp.exe
Even the term “lolbins” is still seeing a jump every year in the trends and even with nothing else this does signify something…I hope.
https://trends.google.com/trends/explore?date=today%205-y&q=lolbinsI could highlight this point even further with more examples from different threat reports but I think looking at real and “infamous” case studies we’ll make the point even clearer.
Case Studies
Below are simply some of the tools and command-line usage seen in this “infmaous” attacks
Wannacry (2017)
Source: WannaCry Malware Profile
icacls . /grant Everyone:F /T /C /Q
attrib +h +s <Drive_Letter>:$RECYCLE
taskkill.exe /f /im sqlserver.exe
taskkill.exe /f /im sqlwriter.exe
taskkill.exe /f /im mysqld.exe
cmd.exe /c start /b @WanaDecryptor@.exe vsvssadmin delete shadows /all /quiet
wmic shadowcopy delete
bcdedit /set {default} bootstatuspolicy ignoreallfailuresbcdedit /set {default} recoveryenabled nowbadmin delete catalog -q
cscript.exe //nologo <1 character>.vbs
Solarwinds (2020)
Source: Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
wmic /node:[target] process call create “rundll32 c:\windows[folder][beacon].dll [export]”
Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\Windows[folder][beacon].dll [export]’ -ComputerName [target]
rundll32.exe c:\windows[folder][beacon].dll [export]
netsh advfirewall firewall add rule name=”[rulename1]” protocol=UDP dir=out localport=137 action=block
schtasks /query /v /s [target] /fo csv
sc \[target] query type=service state=all
wmic /node:”[target]” service get name,startname
reg add HKLM\system\currentcontrolset\services[service name] /v Start /t REG_DWORD /d 4″
Conti Leak (2021)
Source: Conti Manual Leak
whoami /groups
net localgroup administrators
nltest /dclist:[domain]
rundll32.exe C:\windows\System32\comsvcs.dll,MiniDump PID C:\ProgramData\lsass.dmp full
wmic /node: {1} process call create “rundll32.exe C:\ProgramData\2.dll StartW”wmic /node:“DC01” /user:“DOMAIN\admin” /password:“cleartextpass” process call create “cmd / c vssadmin list shadows >> c: \log.txt”
powershell Set-MpPreference -DisableRealtimeMonitoring $true
reg add “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist” /v oldadministrator /t REG_DWORD /d 0 / f
Moonbounce (2022)
Source: MoonBounce: the dark side of UEFI firmware
net start “iscsiwmi”
sc stop iscsiwmi
sc delete iscsiwmi
reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost” /v “iscsiwmi” /t REG_MULTI_SZ /d “iscsiwmi” /f
sc create “iscsiwmi” binPath= “$system32\svchost.exe -k iscsiwmi” type= share start= auto error= ignore DisplayName= “iscsiwmi”
SC failure “iscsiwmi” reset= 86400 actions= restart/60000/restart/60000/restart/60000
sc description “iscsiwmi” ““iSCSI WMI Classes That Manage Initiators, Ports, Sessions and Connections””
reg add “HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters” /f
reg add “HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters” /v “ServiceDll” /t REG_EXPAND_SZ /d “$windir\Microsoft.NET\Framework64\v4.0.30319\System.Mail.Service.dll” /f
net start “iscsiwmi”
No matter the sophistication of the attacker weather be it a supply chain or a UEFI implant at some point in the attack chain LOLBINs “will” be used.
Hunting & Detecting LOLBINs Usage
Whilst the experience of detecting LOLbin’s could and will be different from one company to another (after all these are system binaries or admin utilities getting abused). There are common guidelines that can help.
Keeping Up With The Trends
“You can’t defend what you don’t know” — This mean that if you’re not aware that “certutil” can be abused as a downloader you can’t detect its usage.
Now if you’re one of those who are saying: “No…Don’t focus on the tool focus on the behaviour” know that this article is not aim for you as you’re already ahead of most. So let’s keep it simple for the sake of the blog.
To keep up with the latest LOLBINs in town fortunalty there are a couple of ways:
- LOLBAS-Project
- Infosec twitter and hashtags such as #lolbin
- Projects like MAL-CL that keeps track of how command line utitilites can be “abused”
Baseline and AppControl
In the case where you’re already aware of what’s out there and wondering how can I detect this. Stop and try to block it first instead.
Using stuff like WDAC from Microsoft or something like Symantec’s Adaptive Protection will help you baseline and block the stuff that you don’t use. See link below as an example.
Microsoft recommended block rules (Windows) - Windows security
Log, Collect and Detect
There are some LOLBINs that you can’t do a lot about and in those case detection will come to our help. Having something like command-line logging enabled and Sysmon logging is ver helpful to find these kind of stuff.
SIGMA is a great resource along with others to find detections about these LOLBINs
GitHub - SigmaHQ/sigma: Generic Signature Format for SIEM Systems
Conclusion
As a conclusion, the idea of focusing on LOLBINs might be a controversial one to some. But as I stated multiple times, this blog is here to highlight the importance of LOLBINs in attackers tradecraft and why its shouldn’t be ignored.
As always following a structure like the Pyramid of Pain in your hunting logic, priority and coverage is always a great choice but if you don’t have the necessary resources and your hesitating between behaviour and LOLBINs, I say go for LOLBINs first.
I hope you found the information here useful and helpful. If you want discuss this or anything infosec related you can find me on twitter @nas_bench
Article Link: Why Hunting For LOLBINs Is One Of The Best Bets | by Nasreddine Bencherchali | Medium