Hacker News Reader

Comment by supriyo-biswas | Hacker News Reader

Are LOLBINs still an issue for most companies? I was under the impression that most endpoint detection products simply trace all syscalls, and therefore can somewhat accurately extract information about exploitation events without relying on a "foreign" file artifact.

View on HN

LOLBINs are very much an issue at pretty much every company there is, just because there's a way to detect them doesn't mean they're actually detected, or that an alert is made, or that the alert is triaged correctly, or that EDR is even turned on, etc

it's a needle in the haystack issue. plus most EDR products do not actually alert on benign looking syscalls as it'll quickly cause an false positive overload

I would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.)

I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either.

[1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...

They do, it just doesn't work very well.

They might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult.

A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.

Some are working on it (SentinelOne is a notable player with the capacity), but ML domain experience in the Cybersecurity space is severely lacking as a lot of Cybersecurity PMs and Founders are ex-Networking types who view ML/AI as marketing hype.

Source: am a PM in the space who has been banging heads with these types of people

Every SOC should have simple usecases for these basic lolbins. Such an attack usually lights up the SIEM/SOAR like an xmas tree.

> Are LOLBINs still an issue for most companies?

Depends. The TS/SCI enclave at Raytheon R&D is probably locked down. However, most of the (sub)contracting work is done by small-medium business America and they've never even heard of lolbins.

lolbin is the trash can for all these meaningless technoblab alerts that you laugh at right?

Reply on news.ycombinator.com