4 ms·
"Living off the land" in the context of this document means using readily available command line tools and utilities on infected devices?
by aigoochamna 3y ago
"Living off the land" in the context of this document means using readily available command line tools and utilities on infected devices?
- supriyo-biswas 3y agoYes, see for example [1]. [1] https://github.com/LOLBAS-Project/LOLBAS https://github.com/LOLBAS-Project/LOLBAS
- aigoochamna 3y agoThanks, that makes more sense. Reading the document as an outsider was confusing :p For a minute, I was worried there were some crazy nationalistic Chinese dudes living in the woods behind my house.
- rolph 3y agosummary pgh 3 [One of the actor’s primary tactics, techniques, and procedures (TTPs) is living off the land, which uses built-in network administration tools to perform their objectives. This TTP allows the actor to evade detection by blending in with normal Windows system and network activities, avoid endpoint detection and response (EDR) products that would alert on the introduction of third-party applications to the host, and limit the amount of activity that is captured in default logging configurations. Some of the built-in tools this actor uses are: wmic , ntdsutil , netsh , and PowerShell .]
- _8j50 3y agontdsutil does not ship with windows by default
- ars 3y agoOn Linux servers I always uninstall the compiler and dev tools. I actually wrote a little script to dry-run uninstall every single package on the server one by one, and if uninstalling it doesn't remove anything important I'll go ahead an uninstall it. I'm left with only a bare minimum of stuff, even things like man pages or simple utils I'll uninstall.
- SoftTalker 3y agoIf the intruder as gotten far enough to be in a position to run a compiler, he'll just upload it if it isn't there.
- ars 3y agoMaybe, maybe not. Compilers are quite large, especially once you include dev versions of system libraries.
- red-iron-pine 3y agoif you're uploading a compiler you could just upload a binary. unless it's a very specific system you can probably just put it together "at home" and slap it in there.
- ars 3y agoI think you entirely missed my point. Because there is no compiler they have to upload something. With a compiler they can compile something locally which is easier to do.
- ginko 3y agoKind of disappointing. I was hoping for a story about Chinese cells homesteading in Middle America to avoid detection between their cyber exploits.
- CrzyLngPwd 3y agoSame. I felt clickbaited.
- tiahura 3y agoGiven the recent news about Chinese hacks of Guam, I was thinking sailboat live aboard spies.
- red-iron-pine 3y agoThey're mostly in big cities like Vancouver and NYC. And more concerned with intimidating foreign nationals.
- senectus1 3y agoyeah it seems to be a very hot term in cyber security atm.