Living-off-the-land download cradles

lolbin_download_cradles

Fetches a two-byte file from the benchmark's own endpoint using each signed OS tool an attacker would use for it — certutil, bitsadmin, curl, wget, python, osascript — and records which invocations were stopped. Nothing that is downloaded is executed.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1105	Ingress Tool Transfer	Command and Control	coverage statistics
T1197	BITS Jobs	Defense Evasion	coverage statistics
T1218	System Binary Proxy Execution	Defense Evasion	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other living off the land tests

Other tests in the Living off the land category.
Test	What it does	Severity
Signed script-host execution lolbin_script_host_exec	Uses the signed script hosts — mshta, regsvr32 with scrobj, rundll32, wmic, cscript, osascript, perl, python — to execute an inert instruction that wr…	high
Decoding an encoded payload with a signed tool lolbin_certutil_decode_payload	Writes a base64-encoded EICAR test file and decodes it in place with the platform's own signed decoder (certutil on Windows, base64 elsewhere), which …	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.