# Living-off-the-Land Data Exfiltration via LOLBins

- **Severity:** High
- **Signature ID:** `6f3e9c2a-8b41-4d7a-9f3c-2e5b7a1d4c9e`
- **MITRE ATLAS:** AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This detects an AI agent running standard command-line utilities in patterns known to move data off a machine without going through a monitored web/HTTP connection. Attackers (or a compromised/misused agent) favor these built-in tools because they blend into normal admin activity and evade tools that only watch HTTP traffic.

## How the attack works

An AI agent with command-line execution ability spawns a system utility instead of using its normal HTTP client. This can look like scp/rsync/sftp pushing files to a remote user@host target, netcat/ncat opening a raw TCP connection to send data, openssl s_client used to tunnel local file contents over TLS, sendmail/mutt emailing data out as an attachment or piped input, base64/certutil encoding a file and piping it straight into a transfer tool, or bitsadmin uploading a file via BITS. In each case the data leaves the host through a channel that isn't the agent's usual monitored web request path.

## Why it matters

An organization can lose sensitive data through a channel that its usual network monitoring (focused on HTTP traffic) never sees, because the transfer rides on trusted system utilities instead of the agent's normal outbound connection.

## What you can do

- Restrict which command-line utilities an AI agent is allowed to invoke, and block or gate scp/rsync/sftp/nc/ncat/openssl/sendmail/mutt/certutil/bitsadmin unless explicitly required.
- Log and alert on command lines matching these transfer patterns, not just on the agent's HTTP requests.
- Require known backup/reporting jobs that legitimately use rsync, scp, or mail-based reporting to run from separate service accounts or scheduled tasks, not through the agent's execution context.
- Review egress firewall rules to ensure raw TCP, SMTP, and BITS traffic from agent hosts is restricted to only what's operationally needed.

## Known benign look-alikes

- Legitimate rsync/scp/sftp deployment or backup jobs that push build artifacts or archives to a remote host using the user@host: target syntax
- Scripted TLS/certificate connectivity checks using openssl s_client fed from /dev/null (filtered explicitly)
- Automated reporting jobs that email log files or reports as attachments via sendmail or mutt
- Rare legitimate certutil -encode usage to convert a certificate to base64/PEM format
- Rsync executed with --dry-run during deployment testing (filtered explicitly)

## References

- https://attack.mitre.org/techniques/T1048/
- https://attack.mitre.org/techniques/T1132/

---
Source: https://www.netzilo.com/threats/lolbin-data-exfiltration