Analytics BIOC Informational
✕

A LOLBIN was copied to a different location

To evade detection, attackers may copy a LOLBIN executable to a different location.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading: Rename Legitimate Utilities (T1036.003)
Attacker's goals:

Command execution via lolbins and detection avoidance via file rename.

Investigative actions:

Check whether the executing process is benign and if this was a desired behavior as part of its normal execution flow. Check the destination path of the lolbin and try to see if it's benign.

Test period:
N/A (single event)
Deduplication:
6 Hours
2 variations:
  • A LOLBIN was copied to a different location using a rare command line High (parent: Informational)
  • A LOLBIN was copied to a different location using a rare command line via a commonly used method Low (parent: Informational)