TRY HACK ME Benign
2025 done by https://x.com/KozlowskiTomasz
Link to the room: https://tryhackme.com/r/room/benign
Room done by @Sakib_Janjua
Living Off The Land Binaries and Scripts (LOLBAS) is an open-source project that documents and provides detailed information on how legitimate Windows binaries, scripts, and libraries can be misused for malicious purposes. Here’s a deeper dive into LOLBAS:
Purpose and Overview:
- Documentation: LOLBAS serves as a comprehensive database detailing how attackers can use built-in Windows tools in malicious ways, thus “living off the land” without needing to introduce external tools that might be easily detected.
- Educational Resource: It’s designed to educate both security professionals and system administrators about potential misuse vectors, helping to improve security posture by knowing what to look for in terms of suspicious activity.
Key Features:
Database of Tools:
- Binaries: System executables like certutil.exe, bitsadmin.exe, powershell.exe, etc., which can perform tasks like downloading files, executing code, or data exfiltration.
- Scripts: Includes PowerShell, VBScript, or JavaScript files that can run without additional software.
- Libraries: DLLs that can be loaded or executed in unexpected ways.
Detailed Entries:
- Each entry includes:
- Description: Explanation of the tool’s intended use.
- Abuse Cases: Examples of how the tool can be misused, often with command-line examples.
- Examples: Real-world command examples showcasing misuse.
- OPSEC Considerations: Operational Security concerns, like how usage might be detected or logged.
Community Contribution: LOLBAS is community-driven, allowing security researchers to submit new findings or update existing entries, ensuring the database stays current with new techniques.
Detection Guidance: Offers suggestions on how to detect the misuse of these tools, which is invaluable for SOC (Security Operations Center) analysts and automated security systems.
Examples of LOLBAS Entries:
- Certutil: Documented for its ability to download files via urlcache.
- Mshta: Explains how to execute remote JavaScript or VBScript.
- Regsvr32: Shows how to run SCT files to execute scripts.
- PowerShell: A plethora of abuse cases, from downloading scripts to lateral movement.
Implications for Security:
- Improved Detection: Security teams can tailor their detection rules based on known misuse patterns.
- Forensic Analysis: Helps in incident response by providing insights into what an attacker might have done using native tools.
- Policy Making: Informs the creation of system hardening policies or application control lists to prevent misuse.
Challenges:
- Evasion: As LOLBAS becomes more known, attackers might pivot to less documented or newer misuse techniques.
- Legitimacy: The dual-use nature of these tools makes distinguishing legitimate from malicious use challenging without context.
Accessing LOLBAS:
Get Tomasz Kozlowski’s stories in your inbox
Join Medium for free to get updates from this writer.
The project is hosted on GitHub, where you can access the repository to browse through all documented tools, scripts, and libraries. It’s regularly updated with new findings and community contributions.
LOLBAS thus serves as an essential resource for enhancing security awareness and defense strategies against living-off-the-land attacks.
The questions below:
How many logs are ingested from the month of March, 2022?
Imposter Alert: There seems to be an imposter account observed in the logs, what is the name of that user?
Which user from the HR department was observed to be running scheduled tasks?
Which user from the HR department executed a system process (LOLBIN) to download a payload from a file-sharing host.
To bypass the security controls, which system process (lolbin) was used to download a payload from the internet?
What was the date that this binary was executed by the infected host? format (YYYY-MM-DD)
Which third-party site was accessed to download the malicious payload?
What is the name of the file that was saved on the host machine from the C2 server during the post-exploitation phase?
The suspicious file downloaded from the C2 server contained malicious content with the pattern THM{……….}; what is that pattern?
What is the URL that the infected host connected to?
