{"id":477880,"date":"2023-08-09T09:22:01","date_gmt":"2023-08-09T09:22:01","guid":{"rendered":""},"modified":"2023-09-05T11:15:36","modified_gmt":"2023-09-05T11:15:36","slug":"lolbin","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/kr\/wiki\/lolbin\/","title":{"rendered":"\ub864\ube48"},"content":{"rendered":"<p>&quot;Living Off the Land Binaries&quot;\uc758 \uc57d\uc790\uc778 LOLBin\uc740 \uc0ac\uc774\ubc84 \ubcf4\uc548\uc5d0\uc11c \uc704\ud611 \ud589\uc704\uc790\uac00 \uc545\uc758\uc801\uc778 \ud65c\ub3d9\uc744 \uc218\ud589\ud558\uae30 \uc704\ud574 \uc545\uc6a9\ud560 \uc218 \uc788\ub294 Windows \uc6b4\uc601 \uccb4\uc81c\uc5d0 \uc788\ub294 \ud569\ubc95\uc801\uc778 \uc2e4\ud589 \ud30c\uc77c, \ub3c4\uad6c \ub610\ub294 \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uac00\ub9ac\ud0a4\ub294 \ub370 \uc0ac\uc6a9\ub418\ub294 \uc6a9\uc5b4\uc785\ub2c8\ub2e4. \uc774\ub7ec\ud55c \ubc14\uc774\ub108\ub9ac\ub294 \uc2dc\uc2a4\ud15c\uc5d0 \uae30\ubcf8\uc801\uc73c\ub85c \ud3ec\ud568\ub418\uc5b4 \uc788\uc73c\uba70 \uc77c\ubc18\uc801\uc73c\ub85c \uc0ac\uc774\ubc84 \ubc94\uc8c4\uc790\uac00 \uae30\uc874 \ubcf4\uc548 \uc870\uce58\ub97c \uc6b0\ud68c\ud558\ub294 \ub370 \uc0ac\uc6a9\ud569\ub2c8\ub2e4. \uacf5\uaca9\uc790\ub294 \uc0ac\uc804 \uc124\uce58\ub41c \ubc14\uc774\ub108\ub9ac\ub97c \ud65c\uc6a9\ud558\uc5ec \ud0d0\uc9c0\ub97c \ud53c\ud558\uace0 \ubcf4\uc548 \ub3c4\uad6c\uac00 \ud569\ubc95\uc801\uc778 \ud65c\ub3d9\uacfc \uc545\uc758\uc801\uc778 \ud65c\ub3d9\uc744 \uc2dd\ubcc4\ud558\ub294 \uac83\uc744 \uc5b4\ub835\uac8c \ub9cc\ub4e4 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<h2>LOLBin\uc758 \uc720\ub798\uc640 \ucd5c\ucd08 \uc5b8\uae09\uc758 \uc5ed\uc0ac<\/h2>\n<p>LOLBins\uc758 \uac1c\ub150\uc740 \ubcf4\uc548 \uc5f0\uad6c\uc6d0\ub4e4\uc774 \uc545\uc758\uc801\uc778 \ubaa9\uc801\uc73c\ub85c \ud569\ubc95\uc801\uc778 \uc2dc\uc2a4\ud15c \uc720\ud2f8\ub9ac\ud2f0\ub97c \ud65c\uc6a9\ud558\ub294 \ud30c\uc77c\ub9ac\uc2a4 \uacf5\uaca9\uacfc \uae30\uc220\uc758 \uc99d\uac00\ub97c \uad00\ucc30\ud558\uae30 \uc2dc\uc791\ud55c 2014\ub144\uacbd \uc0ac\uc774\ubc84 \ubcf4\uc548 \ucee4\ubba4\ub2c8\ud2f0\uc5d0\uc11c \ub450\uac01\uc744 \ub098\ud0c0\ub0c8\uc2b5\ub2c8\ub2e4. LOLBins\uc5d0 \ub300\ud55c \uccab \ubc88\uc9f8 \uc5b8\uae09\uc740 2014\ub144 Casey Smith\uac00 \uc791\uc131\ud55c &quot;Living off the Land and EvadingDetection - A Survey of Common Practices&quot;\ub77c\ub294 \uc81c\ubaa9\uc758 \uc5f0\uad6c \ub17c\ubb38\uc5d0\uc11c\uc600\uc2b5\ub2c8\ub2e4. \uc774 \ubb38\uc11c\ub294 \uacf5\uaca9\uc790\uac00 \uae30\ubcf8 \uc81c\uacf5 Windows \ubc14\uc774\ub108\ub9ac\ub97c \uc545\uc6a9\ud558\uc5ec \uc790\uc2e0\uc758 \ud65c\ub3d9\uc744 \uc740\ud3d0\ud558\uace0 \ubcf4\uc548\uc744 \uc720\uc9c0\ud558\ub294 \ubc29\ubc95\uc744 \uc870\uba85\ud588\uc2b5\ub2c8\ub2e4. \ud0d0\uc9c0\ub97c \ud68c\ud53c\ud558\ub2e4<\/p>\n<h2>LOLBin\uc5d0 \ub300\ud55c \uc790\uc138\ud55c \uc815\ubcf4: LOLBin \uc8fc\uc81c \ud655\uc7a5<\/h2>\n<p>LOLBins\ub294 \uc0ac\uc774\ubc84 \uacf5\uaca9\uc790\uac00 \ub808\uc774\ub354\ub97c \ud53c\ud574 \uc774\ub3d9\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ud558\ub294 \uc601\ub9ac\ud55c \uc804\ub7b5\uc744 \ub098\ud0c0\ub0c5\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uc0ac\uc804 \uc124\uce58\ub41c \ubc14\uc774\ub108\ub9ac\ub294 \uacf5\uaca9\uc790\uc5d0\uac8c \ud53c\ud574\uc790\uc758 \ucef4\ud4e8\ud130\uc5d0 \ucd94\uac00 \uc545\uc131 \ud30c\uc77c\uc744 \ub4dc\ub86d\ud560 \ud544\uc694 \uc5c6\uc774 \ub2e4\uc591\ud55c \uba85\ub839\uc744 \uc2e4\ud589\ud558\uace0, \uc2dc\uc2a4\ud15c\uacfc \uc0c1\ud638 \uc791\uc6a9\ud558\uace0, \uc815\ucc30\uc744 \uc218\ud589\ud560 \uc218 \uc788\ub294 \uad11\ubc94\uc704\ud55c \ubb34\uae30\uace0\ub97c \uc81c\uacf5\ud569\ub2c8\ub2e4. \uc774\ub294 \uc77c\ubc18\uc801\uc73c\ub85c \uacf5\uaca9\uc774 \uba54\ubaa8\ub9ac\uc5d0\uc11c\ub9cc \ubc1c\uc0dd\ud558\uace0 \ud558\ub4dc \ub4dc\ub77c\uc774\ube0c\uc5d0 \ud754\uc801\uc744 \uac70\uc758 \ub0a8\uae30\uc9c0 \uc54a\ub294 \ud30c\uc77c\ub9ac\uc2a4 \uacf5\uaca9\uc5d0 \uc0ac\uc6a9\ub429\ub2c8\ub2e4.<\/p>\n<p>LOLBins\uc758 \uc0ac\uc6a9\uc740 \uc885\uc885 \ud1a0\uc9c0 \ud65c\uc6a9 \uc804\uc220, PowerShell \uc2a4\ud06c\ub9bd\ud305 \ubc0f WMI(Windows Management Instrumentation)\uc640 \uac19\uc740 \ub2e4\ub978 \uae30\uc220\uacfc \uacb0\ud569\ub418\uc5b4 \ud6a8\uc728\uc131\uc744 \uadf9\ub300\ud654\ud569\ub2c8\ub2e4. LOLBins\ub294 \uacf5\uaca9\uc790\uac00 \ud569\ubc95\uc801\uc778 \uc2dc\uc2a4\ud15c \ud65c\ub3d9\uc5d0 \ud63c\ud569\ub420 \uc218 \uc788\ub3c4\ub85d \ud558\uc5ec \ubcf4\uc548 \ubd84\uc11d\uac00\uac00 \uc815\uc0c1\uc801\uc778 \ub3d9\uc791\uacfc \uc545\uc758\uc801\uc778 \ub3d9\uc791\uc744 \uad6c\ubcc4\ud558\uae30 \uc5b4\ub835\uac8c \ub9cc\ub4e4\uae30 \ub54c\ubb38\uc5d0 \uc545\uc6a9 \ud6c4 \uc2dc\ub098\ub9ac\uc624\uc5d0\uc11c \ud2b9\ud788 \ud6a8\uacfc\uc801\uc785\ub2c8\ub2e4.<\/p>\n<h2>LOLBin\uc758 \ub0b4\ubd80 \uad6c\uc870: LOLBin\uc758 \uc791\ub3d9 \ubc29\uc2dd<\/h2>\n<p>LOLBins\ub294 \uc6b4\uc601 \uccb4\uc81c\uc5d0 \uc0ac\uc804 \uc124\uce58\ub418\uc5b4 \uc81c\uacf5\ub418\ub294 \uae30\ubcf8 Windows \ubc14\uc774\ub108\ub9ac\uc785\ub2c8\ub2e4. \uc774\ub294 \ud569\ubc95\uc801\uc778 \uae30\ub2a5\uc744 \uac16\uace0 \uc788\uc73c\uba70 \ub2e4\uc591\ud55c \uad00\ub9ac \uc791\uc5c5, \uc2dc\uc2a4\ud15c \uc720\uc9c0 \uad00\ub9ac \ubc0f \ubb38\uc81c \ud574\uacb0\uc744 \uc9c0\uc6d0\ud558\ub3c4\ub85d \uc124\uacc4\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \uacf5\uaca9\uc790\ub294 \uc758\uc2ec\uc744 \ubd88\ub7ec\uc77c\uc73c\ud0a4\uc9c0 \uc54a\uace0 \uc545\uc758\uc801\uc778 \ubaa9\ud45c\ub97c \ub2ec\uc131\ud558\uae30 \uc704\ud574 \uc774\ub7ec\ud55c \ubc14\uc774\ub108\ub9ac\ub97c \uc870\uc791\ud569\ub2c8\ub2e4. LOLBin\uc758 \ub0b4\ubd80 \uad6c\uc870\ub294 \uc77c\ubc18 \uc2dc\uc2a4\ud15c \ubc14\uc774\ub108\ub9ac\uc758 \uad6c\uc870\uc640 \ub3d9\uc77c\ud558\ubbc0\ub85c \ubcf4\uc548 \uc194\ub8e8\uc158\uc774 \ub208\uce58\ucc44\uc9c0 \ubabb\ud558\uac8c \uc791\ub3d9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uc774 \ud504\ub85c\uc138\uc2a4\uc5d0\ub294 \uc77c\ubc18\uc801\uc73c\ub85c \uba85\ub839\uc904 \uc778\uc218\ub97c \uc0ac\uc6a9\ud558\uc5ec \ud2b9\uc815 \uae30\ub2a5\uc744 \ud638\ucd9c\ud558\uac70\ub098 PowerShell \uba85\ub839\uc744 \uc2e4\ud589\ud558\uac70\ub098 \uc911\uc694\ud55c \uc2dc\uc2a4\ud15c \ub9ac\uc18c\uc2a4\uc5d0 \uc561\uc138\uc2a4\ud558\ub294 \uc791\uc5c5\uc774 \ud3ec\ud568\ub429\ub2c8\ub2e4. \uacf5\uaca9\uc790\ub294 LOLBins\ub97c \uc774\uc6a9\ud558\uc5ec \ucf54\ub4dc \uc2e4\ud589, \ud30c\uc77c \uc0dd\uc131 \ub610\ub294 \uc218\uc815, \uc2dc\uc2a4\ud15c \ub808\uc9c0\uc2a4\ud2b8\ub9ac \ucffc\ub9ac, \ub124\ud2b8\uc6cc\ud06c\ub97c \ud1b5\ud55c \ud1b5\uc2e0 \ubc0f \ubaa9\ud45c \ub2ec\uc131\uc5d0 \ud544\uc694\ud55c \uae30\ud0c0 \ud65c\ub3d9\uc744 \uc218\ud589\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<h2>LOLBin\uc758 \uc8fc\uc694 \uae30\ub2a5 \ubd84\uc11d<\/h2>\n<p>LOLBins\ub294 \uc704\ud611 \ud589\uc704\uc790\uc5d0\uac8c \ub9e4\ub825\uc801\uc778 \uba87 \uac00\uc9c0 \uc8fc\uc694 \uae30\ub2a5\uc744 \uc81c\uacf5\ud569\ub2c8\ub2e4.<\/p>\n<ol>\n<li>\n<p><strong>\ud569\ubc95\uc801\uc778 \ubaa8\uc2b5<\/strong>: LOLBins\uc5d0\ub294 \uc720\ud6a8\ud55c \ub514\uc9c0\ud138 \uc11c\uba85\uc774 \uc788\uc73c\uba70 \uc77c\ubc18\uc801\uc73c\ub85c Microsoft\uc5d0\uc11c \uc11c\uba85\ud558\ubbc0\ub85c \uc2e0\ub8b0\ud560 \uc218 \uc788\ub294 \uac83\ucc98\ub7fc \ubcf4\uc774\uace0 \ubcf4\uc548 \uac80\uc0ac\ub97c \uc6b0\ud68c\ud569\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\ud22c\uba85\ud654<\/strong>: LOLBins\ub294 \uae30\ubcf8 \uc2dc\uc2a4\ud15c \ubc14\uc774\ub108\ub9ac\uc774\ubbc0\ub85c \uc704\ud5d8 \uc2e0\ud638\ub97c \ubc1c\uc0dd\uc2dc\ud0a4\uac70\ub098 \ubcf4\uc548 \uc194\ub8e8\uc158\uc758 \uacbd\uace0\ub97c \ud2b8\ub9ac\uac70\ud558\uc9c0 \uc54a\uace0\ub3c4 \uc545\uc131 \ucf54\ub4dc\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc545\uc131 \ucf54\ub4dc \uc0ad\uc81c\uac00 \ud544\uc694\ud558\uc9c0 \uc54a\uc74c<\/strong>: LOLBins\ub294 \uacf5\uaca9\uc790\uac00 \ud53c\ud574\uc790 \uc2dc\uc2a4\ud15c\uc5d0 \ucd94\uac00 \ud30c\uc77c\uc744 \ub4dc\ub86d\ud558\ub3c4\ub85d \uc694\uad6c\ud558\uc9c0 \uc54a\uc73c\ubbc0\ub85c \ud0d0\uc9c0 \uac00\ub2a5\uc131\uc774 \uc904\uc5b4\ub4ed\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc2e0\ub8b0\ud560 \uc218 \uc788\ub294 \ub3c4\uad6c\uc758 \ub0a8\uc6a9<\/strong>: \uacf5\uaca9\uc790\ub294 \uc774\ubbf8 \ud654\uc774\ud2b8\ub9ac\uc2a4\ud2b8\uc5d0 \ub4f1\ub85d\ub418\uc5b4 \uc548\uc804\ud558\ub2e4\uace0 \uac04\uc8fc\ub418\ub294 \ub3c4\uad6c\ub97c \ud65c\uc6a9\ud558\ubbc0\ub85c \ubcf4\uc548 \ub3c4\uad6c\uac00 \ud569\ubc95\uc801\uc778 \uc0ac\uc6a9\uacfc \uc545\uc758\uc801\uc778 \uc0ac\uc6a9\uc744 \uad6c\ubcc4\ud558\uae30 \uc5b4\ub835\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\ud30c\uc77c \uc5c6\ub294 \uc2e4\ud589<\/strong>: LOLBins\ub294 \ud30c\uc77c\ub9ac\uc2a4 \uacf5\uaca9\uc744 \uac00\ub2a5\ud558\uac8c \ud558\uc5ec \ub514\uc9c0\ud138 \uacf5\uac04\uc744 \uc904\uc774\uace0 \ud3ec\ub80c\uc2dd \uc870\uc0ac\uc758 \ubcf5\uc7a1\uc131\uc744 \ub192\uc785\ub2c8\ub2e4.<\/p>\n<\/li>\n<\/ol>\n<h2>LOLBin\uc758 \uc885\ub958<\/h2>\n<table>\n<thead>\n<tr>\n<th>LOLBin \uc720\ud615<\/th>\n<th>\uc124\uba85<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\ud30c\uc6cc\uc178 \uc2a4\ud06c\ub9bd\ud2b8<\/td>\n<td>Windows\uc758 \uac15\ub825\ud55c \uc2a4\ud06c\ub9bd\ud2b8 \uc5b8\uc5b4\uc778 PowerShell\uc744 \ud65c\uc6a9\ud558\uc5ec \uc545\uc758\uc801\uc778 \ud65c\ub3d9\uc744 \uc218\ud589\ud569\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>WMI(Windows \uad00\ub9ac \uacc4\uce21)<\/td>\n<td>WMI\ub97c \ud65c\uc6a9\ud558\uc5ec \ub300\uc0c1 \uc2dc\uc2a4\ud15c\uc5d0\uc11c \uc2a4\ud06c\ub9bd\ud2b8\uc640 \uba85\ub839\uc744 \uc6d0\uaca9\uc73c\ub85c \uc2e4\ud589\ud569\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>Windows \uba85\ub839 \ud504\ub86c\ud504\ud2b8(cmd.exe)<\/td>\n<td>\uae30\ubcf8 Windows \uba85\ub839\uc904 \ud574\uc11d\uae30\ub97c \ud65c\uc6a9\ud558\uc5ec \uba85\ub839\uacfc \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uc2e4\ud589\ud569\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>Windows \uc2a4\ud06c\ub9bd\ud2b8 \ud638\uc2a4\ud2b8(wscript.exe, cscript.exe)<\/td>\n<td>VBScript \ub610\ub294 JScript\ub85c \uc791\uc131\ub41c \uc2a4\ud06c\ub9bd\ud2b8\ub97c \uc2e4\ud589\ud569\ub2c8\ub2e4.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>LOLBin\uc758 \uc0ac\uc6a9\ubc29\ubc95, \uc0ac\uc6a9\uc5d0 \ub530\ub978 \ubb38\uc81c\uc810 \ubc0f \ud574\uacb0 \ubc29\ubc95<\/h2>\n<h3>LOLBin\uc744 \uc0ac\uc6a9\ud558\ub294 \ubc29\ubc95<\/h3>\n<ol>\n<li>\n<p><strong>\uad8c\ud55c \uc2b9\uaca9<\/strong>: LOLBins\ub294 \uc190\uc0c1\ub41c \uc2dc\uc2a4\ud15c\uc5d0 \ub300\ud55c \uad8c\ud55c\uc744 \ub192\uc774\uace0 \ubbfc\uac10\ud55c \uc815\ubcf4 \ubc0f \ub9ac\uc18c\uc2a4\uc5d0 \ub300\ud55c \uc561\uc138\uc2a4 \uad8c\ud55c\uc744 \uc5bb\ub294 \ub370 \uc0ac\uc6a9\ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc815\ubcf4 \uc218\uc9d1<\/strong>: \uc704\ud611 \ud589\uc704\uc790\ub294 LOLBins\ub97c \ud65c\uc6a9\ud558\uc5ec \uc124\uce58\ub41c \uc18c\ud504\ud2b8\uc6e8\uc5b4, \ub124\ud2b8\uc6cc\ud06c \uad6c\uc131, \uc0ac\uc6a9\uc790 \uacc4\uc815 \ub4f1 \ub300\uc0c1 \uc2dc\uc2a4\ud15c\uc5d0 \ub300\ud55c \uc815\ubcf4\ub97c \uc218\uc9d1\ud569\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uce21\uba74 \uc6b4\ub3d9<\/strong>: \uacf5\uaca9\uc790\ub294 LOLBins\ub97c \uc0ac\uc6a9\ud558\uc5ec \ub124\ud2b8\uc6cc\ud06c \ub0b4\uc5d0\uc11c \uce21\uba74\uc73c\ub85c \uc774\ub3d9\ud558\uace0 \ud55c \uc2dc\uc2a4\ud15c\uc5d0\uc11c \ub2e4\ub978 \uc2dc\uc2a4\ud15c\uc73c\ub85c \ub3c4\uc57d\ud558\ub294 \ub3d9\uc2dc\uc5d0 \uc740\ubc00\ud55c \uc0c1\ud0dc\ub97c \uc720\uc9c0\ud569\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uace0\uc9d1<\/strong>: LOLBins\ub97c \uc0ac\uc6a9\ud558\uba74 \uacf5\uaca9\uc790\uac00 \uc190\uc0c1\ub41c \uc2dc\uc2a4\ud15c\uc5d0 \uc9c0\uc18d\uc131\uc744 \uc124\uc815\ud558\uc5ec \uc7a5\uae30\uac04 \uc561\uc138\uc2a4\ub97c \uc720\uc9c0\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<\/ol>\n<h3>\uc774\uc6a9\uc5d0 \ub530\ub978 \ubb38\uc81c\uc810 \ubc0f \ud574\uacb0 \ubc29\ubc95<\/h3>\n<p>LOLBins\uc758 \uc0ac\uc6a9\uc740 \uc0ac\uc774\ubc84 \ubcf4\uc548 \uc804\ubb38\uac00\uc5d0\uac8c \uc2ec\uac01\ud55c \uacfc\uc81c\ub97c \uc548\uaca8\uc90d\ub2c8\ub2e4. \uc77c\ubd80 \ubb38\uc81c\ub294 \ub2e4\uc74c\uacfc \uac19\uc2b5\ub2c8\ub2e4.<\/p>\n<ol>\n<li>\n<p><strong>\ubc1c\uac01<\/strong>: \uae30\uc874\uc758 \uc11c\uba85 \uae30\ubc18 \ubcf4\uc548 \ub3c4\uad6c\ub294 \ud569\ubc95\uc801\uc778 \ud2b9\uc131\uacfc \uc54c\ub824\uc9c4 \uc545\uc131 \ucf54\ub4dc \ud328\ud134\uc758 \ubd80\uc871\uc73c\ub85c \uc778\ud574 LOLBins\ub97c \ud0d0\uc9c0\ud558\ub294 \ub370 \uc5b4\ub824\uc6c0\uc744 \uacaa\uc744 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc2dc\uacc4<\/strong>: LOLBins\uc740 \ud569\ubc95\uc801\uc778 \uc2dc\uc2a4\ud15c \ud504\ub85c\uc138\uc2a4 \ub0b4\uc5d0\uc11c \uc791\ub3d9\ud558\uae30 \ub54c\ubb38\uc5d0 \ud589\ub3d9 \ubd84\uc11d \uae30\ubc18 \ud0d0\uc9c0\ub97c \ud68c\ud53c\ud558\ub294 \uacbd\uc6b0\uac00 \ub9ce\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\ud654\uc774\ud2b8\ub9ac\uc2a4\ud2b8<\/strong>: \uacf5\uaca9\uc790\ub294 \uc54c\ub824\uc9c4 \ubc14\uc774\ub108\ub9ac\uac00 \uc81c\ud55c \uc5c6\uc774 \uc2e4\ud589\ub418\ub3c4\ub85d \ud5c8\uc6a9\ud558\ub294 \ud654\uc774\ud2b8\ub9ac\uc2a4\ud2b8 \uba54\ucee4\ub2c8\uc998\uc744 \ub0a8\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc644\ud654<\/strong>: LOLBins\ub294 \ud544\uc218 \uc2dc\uc2a4\ud15c \uae30\ub2a5\uc744 \uc218\ud589\ud558\ubbc0\ub85c \uc644\uc804\ud788 \ube44\ud65c\uc131\ud654\ud558\uac70\ub098 \ucc28\ub2e8\ud558\ub294 \uac83\uc740 \ubd88\uac00\ub2a5\ud569\ub2c8\ub2e4.<\/p>\n<\/li>\n<\/ol>\n<p>\uc774\ub7ec\ud55c \uacfc\uc81c\ub97c \ud574\uacb0\ud558\ub824\uba74 \uc870\uc9c1\uc740 \ub2e4\uc74c\uc744 \ud3ec\ud568\ud558\ub294 \ub2e4\uacc4\uce35 \ubcf4\uc548 \uc811\uadfc \ubc29\uc2dd\uc744 \ucc44\ud0dd\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n<ul>\n<li><strong>\ud589\ub3d9 \ubd84\uc11d<\/strong>: \ud589\ub3d9 \uae30\ubc18 \ud0d0\uc9c0 \ubc29\ubc95\uc744 \uc0ac\uc6a9\ud558\uc5ec \ud569\ubc95\uc801\uc778 \ubc14\uc774\ub108\ub9ac \ub0b4\uc5d0\uc11c\ub3c4 \ube44\uc815\uc0c1\uc801\uc778 \ud65c\ub3d9\uc744 \uc2dd\ubcc4\ud569\ub2c8\ub2e4.<\/li>\n<li><strong>\uc774\uc0c1 \ud0d0\uc9c0<\/strong>: \uc774\uc0c1 \uac10\uc9c0\ub97c \ud65c\uc6a9\ud558\uc5ec \uc815\uc0c1\uc801\uc778 \uc2dc\uc2a4\ud15c \ub3d9\uc791\uc5d0\uc11c \ubc97\uc5b4\ub09c \ubd80\ubd84\uc744 \ucc3e\uc544\ub0c5\ub2c8\ub2e4.<\/li>\n<li><strong>\uc5d4\ub4dc\ud3ec\uc778\ud2b8 \ubcf4\ud638<\/strong>: \ud30c\uc77c\ub9ac\uc2a4 \uacf5\uaca9\uacfc \uba54\ubaa8\ub9ac \uae30\ubc18 \uacf5\uaca9\uc744 \ud0d0\uc9c0\ud560 \uc218 \uc788\ub294 \uace0\uae09 \uc5d4\ub4dc\ud3ec\uc778\ud2b8 \ubcf4\ud638 \ub3c4\uad6c\uc5d0 \ud22c\uc790\ud558\uc138\uc694.<\/li>\n<li><strong>\uc0ac\uc6a9\uc790 \uad50\uc721<\/strong>: LOLBin \uae30\ubc18 \uacf5\uaca9\uc744 \uc804\ub2ec\ud558\ub294 \uc77c\ubc18\uc801\uc778 \ubca1\ud130\uc778 \ud53c\uc2f1 \ubc0f \uc0ac\ud68c \uacf5\ud559\uc758 \uc704\ud5d8\uc5d0 \ub300\ud574 \uc0ac\uc6a9\uc790\ub97c \uad50\uc721\ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n<h2>\uc8fc\uc694 \ud2b9\uc9d5 \ubc0f \uae30\ud0c0 \uc720\uc0ac \uc6a9\uc5b4\uc640\uc758 \ube44\uad50<\/h2>\n<table>\n<thead>\n<tr>\n<th>\uc6a9\uc5b4<\/th>\n<th>\uc124\uba85<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\ub864\ube48<\/td>\n<td>\uc545\uc758\uc801\uc778 \ubaa9\uc801\uc73c\ub85c \uc545\uc6a9\ub418\ub294 \ud569\ubc95\uc801\uc778 \uc2dc\uc2a4\ud15c \ubc14\uc774\ub108\ub9ac\uc785\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>\ud30c\uc77c\ub9ac\uc2a4 \uacf5\uaca9<\/td>\n<td>\ub300\uc0c1 \uc2dc\uc2a4\ud15c\uc5d0 \ud30c\uc77c\uc744 \uc0ad\uc81c\ud558\uc9c0 \uc54a\uace0 \uba54\ubaa8\ub9ac\uc5d0\uc11c\ub9cc \uc791\ub3d9\ud558\ub294 \uacf5\uaca9\uc785\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>\ud30c\uc6cc\uc178 \uc81c\uad6d<\/td>\n<td>\uacf5\uaca9\uc801\uc778 \uc791\uc5c5\uc744 \uc704\ud574 PowerShell\uc744 \ud65c\uc6a9\ud558\ub294 \uc545\uc6a9 \ud6c4 \ud504\ub808\uc784\uc6cc\ud06c\uc785\ub2c8\ub2e4.<\/td>\n<\/tr>\n<tr>\n<td>\ud1a0\uc9c0 \uc804\uc220\uc5d0\uc11c \uc0dd\ud65c\ud558\uae30<\/td>\n<td>\uc545\uc758\uc801\uc778 \ud65c\ub3d9\uc744 \uc704\ud574 \ub0b4\uc7a5\ub41c \ub3c4\uad6c\ub97c \ud65c\uc6a9\ud569\ub2c8\ub2e4.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\ub864\ube48\uacfc \uad00\ub828\ub41c \ubbf8\ub798\uc758 \uad00\uc810\uacfc \uae30\uc220<\/h2>\n<p>\uae30\uc220\uc774 \ubc1c\uc804\ud568\uc5d0 \ub530\ub77c \uacf5\uaca9\uc790\uc640 \ubc29\uc5b4\uc790 \ubaa8\ub450\uac00 \uc0ac\uc6a9\ud558\ub294 \uae30\uc220\ub3c4 \ubc1c\uc804\ud560 \uac83\uc785\ub2c8\ub2e4. LOLBins\uc758 \ubbf8\ub798\uc640 \ub300\uc751\ucc45\uc740 \ub2e4\uc74c\uacfc \uac19\uc2b5\ub2c8\ub2e4.<\/p>\n<ol>\n<li>\n<p><strong>AI \uae30\ubc18 \ud0d0\uc9c0<\/strong>: AI \uae30\ubc18 \ubcf4\uc548 \uc194\ub8e8\uc158\uc740 \ubc29\ub300\ud55c \uc591\uc758 \ub370\uc774\ud130\ub97c \ubd84\uc11d\ud558\uace0 \uc545\uc758\uc801\uc778 \ud589\uc704\ub97c \ub098\ud0c0\ub0b4\ub294 \ud328\ud134\uc744 \uc2dd\ubcc4\ud558\uc5ec LOLBin \uae30\ubc18 \uacf5\uaca9\uc5d0 \ub300\ud55c \ud0d0\uc9c0 \ubc0f \uc608\ubc29 \uae30\ub2a5\uc744 \ud5a5\uc0c1\uc2dc\ud0b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\ud589\ub3d9 \ubd84\uc11d \uac1c\uc120 \uc0ac\ud56d<\/strong>: \ud589\ub3d9 \uae30\ubc18 \ud0d0\uc9c0 \uba54\ucee4\ub2c8\uc998\uc740 \ub354\uc6b1 \uc815\uad50\ud574\uc9c0\uace0 \ud569\ubc95\uc801\uc778 \ud65c\ub3d9\uacfc \uc545\uc758\uc801\uc778 \ud65c\ub3d9\uc744 \ub354 \uc798 \uc2dd\ubcc4\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc81c\ub85c \ud2b8\ub7ec\uc2a4\ud2b8 \uc544\ud0a4\ud14d\ucc98<\/strong>: \uc870\uc9c1\uc740 \uc81c\ub85c \ud2b8\ub7ec\uc2a4\ud2b8 \uc6d0\uce59\uc744 \ucc44\ud0dd\ud558\uc5ec \uc2e4\ud589\uc744 \ud5c8\uc6a9\ud558\uae30 \uc804\uc5d0 \uac01 \uc791\uc5c5\uc744 \ud655\uc778\ud568\uc73c\ub85c\uc368 LOLBins\uc758 \uc601\ud5a5\uc744 \uc904\uc77c \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\ud558\ub4dc\uc6e8\uc5b4 \ubcf4\uc548<\/strong>: \ud558\ub4dc\uc6e8\uc5b4 \uae30\ubc18 \ubcf4\uc548 \uae30\ub2a5\uc740 \ub354 \uac15\ub825\ud55c \uaca9\ub9ac \ubc0f \ubb34\uacb0\uc131 \uac80\uc0ac\ub97c \uc2dc\ud589\ud558\uc5ec LOLBin \uacf5\uaca9\uc744 \ub9c9\ub294 \ub370 \ub3c4\uc6c0\uc774 \ub420 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<\/ol>\n<h2>\ud504\ub85d\uc2dc \uc11c\ubc84\ub97c \uc0ac\uc6a9\ud558\uac70\ub098 LOLBin\uacfc \uc5f0\uacb0\ud558\ub294 \ubc29\ubc95<\/h2>\n<p>\ud504\ub85d\uc2dc \uc11c\ubc84\ub294 LOLBin \uae30\ubc18 \uacf5\uaca9\uc744 \ubc29\uc5b4\ud558\ub294 \ub370 \uc911\uc694\ud55c \uc5ed\ud560\uc744 \ud569\ub2c8\ub2e4. \ub2e4\uc74c\uacfc \uac19\uc740 \ubc29\ubc95\uc73c\ub85c \uc0ac\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<ol>\n<li>\n<p><strong>\uad50\ud1b5 \uc810\uac80<\/strong>: \ud504\ub85d\uc2dc \uc11c\ubc84\ub294 \uc77c\ubc18\uc801\uc73c\ub85c LOLBins\uc640 \uad00\ub828\ub41c \ud1b5\uc2e0\uc744 \ud3ec\ud568\ud558\uc5ec \uc758\uc2ec\uc2a4\ub7ec\uc6b4 \ud328\ud134\uc5d0 \ub300\ud574 \ub124\ud2b8\uc6cc\ud06c \ud2b8\ub798\ud53d\uc744 \uac80\uc0ac\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc545\uc131 \ucf58\ud150\uce20 \ud544\ud130\ub9c1<\/strong>: \ud504\ub85d\uc2dc\ub294 LOLBin \uc6b4\uc601\uc790\uac00 \uc0ac\uc6a9\ud558\ub294 \uc54c\ub824\uc9c4 \uc545\uc131 \ub3c4\uba54\uc778 \ubc0f IP \uc8fc\uc18c\uc5d0 \ub300\ud55c \uc561\uc138\uc2a4\ub97c \ucc28\ub2e8\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>SSL\/TLS \ubcf5\ud638\ud654<\/strong>: \ud504\ub85d\uc2dc\ub294 \uc554\ud638\ud654\ub41c \ud2b8\ub798\ud53d\uc744 \ud574\ub3c5\ud558\uace0 \uac80\uc0ac\ud558\uc5ec LOLBins\ub97c \ud1b5\ud574 \uc804\ub2ec\ub418\ub294 \uc545\uc131 \ud398\uc774\ub85c\ub4dc\ub97c \ud0d0\uc9c0\ud558\uace0 \ucc28\ub2e8\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<li>\n<p><strong>\uc775\uba85\ud654 \ud0d0\uc9c0<\/strong>: \ud504\ub85d\uc2dc\ub294 \uc775\uba85\ud654 \uae30\uc220\uc744 \uc0ac\uc6a9\ud558\uc5ec LOLBin \ud2b8\ub798\ud53d\uc744 \uc228\uae30\ub824\ub294 \uc2dc\ub3c4\ub97c \uc2dd\ubcc4\ud558\uace0 \ucc28\ub2e8\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n<\/li>\n<\/ol>\n<h2>\uad00\ub828\ub41c \ub9c1\ud06c\ub4e4<\/h2>\n<p>LOLBins \ubc0f \uc0ac\uc774\ubc84 \ubcf4\uc548 \ubaa8\ubc94 \uc0ac\ub840\uc5d0 \ub300\ud55c \uc790\uc138\ud55c \ub0b4\uc6a9\uc740 \ub2e4\uc74c \ub9ac\uc18c\uc2a4\ub97c \ucc38\uc870\ud558\uc138\uc694.<\/p>\n<ol>\n<li><a href=\"https:\/\/www.blackhat.com\/docs\/us-15\/materials\/us-15-Smith-Living-Off-The-Land-And-Evading-Endpoint-Security-For-Fun-And-Profit.pdf\" target=\"_new\" rel=\"noopener nofollow\">\ud1a0\uc9c0\uc5d0\uc11c \uc0dd\ud65c\ud558\uace0 \ud0d0\uc9c0 \ud68c\ud53c \u2013 \uc77c\ubc18\uc801\uc778 \uad00\ud589\uc5d0 \ub300\ud55c \uc870\uc0ac<\/a> \u2013 Casey Smith\uc758 \uc5f0\uad6c \ub17c\ubb38, 2014.<\/li>\n<li><a href=\"https:\/\/attack.mitre.org\/techniques\/T1218\/\" target=\"_new\" rel=\"noopener nofollow\">MITRE ATT&amp;CK \u2013 \ub864\ube48\uc2a4<\/a> \u2013 MITRE ATT&amp;CK \ud504\ub808\uc784\uc6cc\ud06c\uc758 LOLBins\uc5d0 \ub300\ud55c \uc815\ubcf4.<\/li>\n<li><a href=\"https:\/\/www.sans.org\/cyber-security-summit\/archives\/file\/summit-archive-1492182931.pdf\" target=\"_new\" rel=\"noopener nofollow\">LOLBAS\uc5d0 \ub300\ud55c \ubc29\uc5b4<\/a> \u2013 Living Off the Land \ubc14\uc774\ub108\ub9ac \ubc0f \uc2a4\ud06c\ub9bd\ud2b8 \ubc29\uc5b4\uc5d0 \uad00\ud55c \ubc31\uc11c.<\/li>\n<\/ol>\n<p>LOLBins\ub294 \ub04a\uc784\uc5c6\uc774 \uc9c4\ud654\ud558\ub294 \uc0ac\uc774\ubc84 \ubcf4\uc548 \ud658\uacbd\uc5d0\uc11c \uc911\uc694\ud55c \uacfc\uc81c\ub97c \uc81c\uc2dc\ud569\ub2c8\ub2e4. \uc774\ub7ec\ud55c \uad50\ud65c\ud55c \uc704\ud611\uc73c\ub85c\ubd80\ud130 \uc2dc\uc2a4\ud15c\uacfc \ub370\uc774\ud130\ub97c \ubcf4\ud638\ud558\ub824\uba74 \ud574\ub2f9 \uae30\uc220\uc744 \uc774\ud574\ud558\uace0 \uc0ac\uc804 \ubc29\uc5b4 \uc804\ub7b5\uc744 \ucc44\ud0dd\ud558\ub294 \uac83\uc774 \uc911\uc694\ud569\ub2c8\ub2e4.<\/p>","protected":false},"featured_media":477881,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477880","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>LOLBin: Living Off the Land Binaries for Cybersecurity<\/mark>","faq_items":[{"question":"What is LOLBin?","answer":"<p>LOLBin, short for \"Living Off the Land Binaries,\" refers to legitimate executables, tools, or scripts on a Windows operating system that cyber adversaries abuse for malicious activities. These pre-installed binaries allow attackers to evade detection and execute various commands without raising suspicion.<\/p>"},{"question":"How did LOLBin originate?","answer":"<p>The concept of LOLBins gained prominence around 2014 when researchers noticed an increase in fileless attacks and techniques using built-in Windows binaries for malicious purposes. The term was first mentioned in a research paper titled \"Living off the Land and Evading Detection - A Survey of Common Practices\" by Casey Smith in 2014.<\/p>"},{"question":"How do LOLBins work?","answer":"<p>LOLBins are native Windows binaries that come pre-installed on the system, designed for legitimate administrative tasks. Cybercriminals manipulate these binaries to perform malicious activities, leveraging their legitimate appearance and functionalities to avoid detection.<\/p>"},{"question":"What are the key features of LOLBins?","answer":"<p>LOLBins offer several key features that attract threat actors, including their legitimate appearance, invisibility, fileless execution, and abuse of trusted tools.<\/p>"},{"question":"What types of LOLBins exist?","answer":"<p>LOLBins come in various types, including PowerShell Scripts, Windows Management Instrumentation (WMI), Windows Command Prompt (cmd.exe), and Windows Script Host (wscript.exe, cscript.exe).<\/p>"},{"question":"How are LOLBins used, and what are the associated problems?","answer":"<p>LOLBins are used for privilege escalation, information gathering, lateral movement, and persistence. The associated problems include difficulty in detection, visibility, whitelisting abuse, and mitigation challenges.<\/p>"},{"question":"How can organizations counter LOLBin-based attacks?","answer":"<p>Organizations can adopt a multi-layered security approach involving behavioral analysis, anomaly detection, advanced endpoint protection, and user education to mitigate LOLBin threats effectively.<\/p>"},{"question":"What are the future perspectives and technologies related to LOLBins?","answer":"<p>The future of LOLBins may involve AI-driven detection, enhanced behavioral analysis, zero trust architecture, and hardware-based security features to combat these threats effectively.<\/p>"},{"question":"How can proxy servers help with LOLBin defense?","answer":"<p>Proxy servers can assist in LOLBin defense by inspecting traffic, filtering malicious content, decrypting SSL\/TLS traffic, and detecting anonymization attempts.<\/p>"},{"question":"Where can I find more information about LOLBins?","answer":"<p>For more information on LOLBins and cybersecurity best practices, refer to the provided related links, research papers, and the MITRE ATT&amp;CK framework.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/wiki\/477880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/wiki\/477880\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/media\/477881"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/kr\/wp-json\/wp\/v2\/media?parent=477880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}