4 ms·
Are LOLBINs still an issue for most companies? I was under the impression that most endpoint detection products simply trace all syscalls, and therefore can som
by supriyo-biswas 3y ago
Are LOLBINs still an issue for most companies? I was under the impression that most endpoint detection products simply trace all syscalls, and therefore can somewhat accurately extract information about exploitation events without relying on a "foreign" file artifact.
- waihtis 3y agoit's a needle in the haystack issue. plus most EDR products do not actually alert on benign looking syscalls as it'll quickly cause an false positive overload
- supriyo-biswas 3y agoI would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.) I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either. [1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/ https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...
- some_random 3y agoThey do, it just doesn't work very well.
- waihtis 3y agoThey might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult. A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.
- alephnerd 3y agoSome are working on it (SentinelOne is a notable player with the capacity), but ML domain experience in the Cybersecurity space is severely lacking as a lot of Cybersecurity PMs and Founders are ex-Networking types who view ML/AI as marketing hype. Source: am a PM in the space who has been banging heads with these types of people
- some_random 3y agoLOLBINs are very much an issue at pretty much every company there is, just because there's a way to detect them doesn't mean they're actually detected, or that an alert is made, or that the alert is triaged correctly, or that EDR is even turned on, etc
- kryogen1c 3y ago> Are LOLBINs still an issue for most companies? Depends. The TS/SCI enclave at Raytheon R&D is probably locked down. However, most of the (sub)contracting work is done by small-medium business America and they've never even heard of lolbins.
- IIAOPSW 3y agololbin is the trash can for all these meaningless technoblab alerts that you laugh at right?
- dobin 3y agoEvery SOC should have simple usecases for these basic lolbins. Such an attack usually lights up the SIEM/SOAR like an xmas tree.