LOLBlue : Living Off the Land with Blue Team tools#

Maxence Fossat, Antoine C (Synacktiv)

• Why: DFIR tools are pre-deployed, privileged readers of memory and protected files — inverting them into offensive LOLBins creates a detection blind spot squarely in the PM's network-security remit.
• What: A systematic review of forensic/collection tools (Velociraptor, KAPE, DFIR-ORC and lesser-explored others) repurposed for credential access and covert exfiltration, expanding the known LOLDFIR toolkit, plus detection opportunities and the events to monitor. (from abstract only)
• How: Analysis of how each tool accesses low-level filesystem/memory data, including abuse of Velociraptor's client/server architecture, with real-world scenarios demonstrating security-tool bypass.
• Where applicable: Any organization that deploys or pre-installs these tools; realistic in late-stage red team engagements after initial execution. General technique.