Misbehaving binaries: How to detect LOLBin abuse in the wild

Ever found yourself looking at a normal program that isn’t behaving quite the way it should be? Do you have trouble pinpointing baselines and maintaining effective detections on default Microsoft binaries? These LOLBins are no laughing matter. In this break down of Rachel Schwalk’s talk at BSides KC 2023, we talk about abnormal activity leveraging this commonly seen tactic.

LOLBin taxonomy

Living-off-the-land binaries, or LOLBins, are binaries that are already native in the operating system or can be downloaded directly from Microsoft. Many of these default binaries can be used for malicious purposes—in fact, 35 percent of all malicious and suspicious Red Canary detections in 2022 incorporated LOLBins. Rachel confirms that this doesn’t include testing or non-malicious behavior; these are all threats creeping out of the woods, so to speak. Commonly abused binaries include:

• rundll32
• regsvr32
• msbuild
• msiexec
• mshta 

It is difficult for defenders to easily differentiate malicious and normal LOLBin behavior. Tools such as EchoTrail provide information on what is normal for these binaries. The nature of these binaries can make it difficult to keep track of normality, though.

“Usually PowerShell and other scripting engines get a lot of love,” Rachel notes, speaking on usual detection methods, “while rundll32, regsvr32, msbuild, msiexec, and mshta are the underdogs when comparing to PowerShell.”

Curious behavior

In order to detect LOLBins, one must know not only the definition of a misbehaving binary, but also the behavior of each individual binary. Researching the purpose of the binary offers a lot of helpful information about whether it should be using network connections, what its usual path should be, and any typical command-line parameters that it uses in execution.

Normal behavior isn’t just for understanding common activity. “After you baseline normal you’re going to look for how this binary can be abused,” notes Rachel, “then you’ll look at what malware families are doing to abuse that binary.”

As an example, Rachel presents a few examples of behavior that aren’t associated with a specific binary, like:

• Downloading from a remote resource
• Executing with an unexpected command line
• Proxying execution through another process
• Executing from an unexpected path
• Misuse of a legitimate function

Exploring rundll32

The rundll32 binary enables the execution of dynamic link libraries, or DLLs. It typically executes from the C:\Windows\System32 or C:\Windows\SysWOW64 folders, with network connections to port 443 and port 80 classified as normal behavior. It executes with a command line, using the format of rundll32.exe {DLLname, DLLfunction}, which can provide a next point of investigation.

Rundll32 also has common parents in processes like svchost, explorer, spoolsv (the printer spooler service), or even rundll32, making it both a parent and child process to itself. Other child processes include winsat and dfsvc, the Windows system assessment tool and the distributed file system service, respectively.

When rundll32 is abused, it’s often by abusing legitimate DLLs or export functions to perform malicious actions; comsvcs.dll can be used to dump the process memory of LSASS by calling the MiniDump function through rundll32, for instance. It can also be abused by executing malicious, adversary-supplied DLLs, as seen with threats like Emotet. Another example of abuse is the use of legitimate functions to bypass application control solutions, like using DLLRegisterServer (which is typically used by regsvr32) to register and execute a DLL that can then be used for malicious purposes.

Evidence of this sort of abnormal behavior represents itself in logging through any aberrations from the more regular behaviors listed above. Unusual process executions, like JavaScript and PowerShell with rundll32.exe as a parent process, can indicate a malicious code execution. Initial downloads and executions from remote sources are also suspect depending on sources: for example, DLLs executing in an Alternate Data Stream (ADS) or rundll32 executing without command-line parameters.

“Rundll32 should always be executing with the DLL name and function, so when it doesn’t that could be a sign that something’s up,” notes Rachel.

Evil things

Many famous threats use rundll32 as their agent of chaos. Among them are many that were featured in the 2023 Threat Detection Report, as they were the most commonly seen in Red Canary customer environments.

Qbot

Though its infrastructure was taken down by law enforcement in summer 2023, Qbot is a long-time heavy hitter with a lot of interesting techniques, being primarily used by financially motivated threat actors since 2007. The activity that indicated some curious goings-on was as follows: