{"id":42180,"date":"2021-09-28T15:17:06","date_gmt":"2021-09-28T19:17:06","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=42180"},"modified":"2021-09-28T15:17:06","modified_gmt":"2021-09-28T19:17:06","slug":"most-used-lolbins","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/most-used-lolbins\/42180\/","title":{"rendered":"Cybercriminals’ top LOLBins"},"content":{"rendered":"

Cybercriminals have long used legitimate programs and operating system components to attack Microsoft Windows users, a tactic known as Living off the Land<\/a>. In doing so, they\u2019re attempting to kill several birds with one cyberstone, reducing the cost of developing a malware toolkit, minimizing their operating system footprint, and disguising their activity among legitimate IT actions.<\/p>\n

In other words, the main objective is to make detecting their malicious activity harder. For this reason, security experts have long monitored the activity of potentially unsafe executables, scripts, and libraries, going so far as to maintain a kind of registry under the LOLBAS project on GitHub<\/a>.<\/p>\n

Our colleagues from Kaspersky Managed Detection and Response (MDR)<\/a> service, who protect numerous companies across a wide range of business areas, often see this approach in real-life attacks. In the Managed Detection and Response Analyst Report<\/a>, they examine the system components most typically used to attack modern businesses. Here\u2019s what they discovered.<\/p>\n

Gold goes to PowerShell<\/h2>\n

PowerShell, a software engine and scripting language with a command-line interface, is the most common legitimate tool by far among cybercriminals, despite Microsoft\u2019s efforts to make it more secure and controllable. Of the incidents identified by our MDR service, 3.3% involved an attempted PowerShell exploit. What\u2019s more, restricting the survey to critical incidents only, we see that PowerShell had a hand in one in five (20.3%, to be precise).<\/p>\n

Silver goes to rundll32.exe<\/h2>\n

In second place we have the rundll32 host process, which is used to run code from dynamic-link libraries (DLLs). It was involved in 2% of all incidents, and 5.1% of critical ones.<\/p>\n

Bronze goes to several utilities<\/h2>\n

We found five tools featured in 1.9% of all incidents:<\/p>\n