Challenge 12: Living Off The Land

Medium Process Monitoring Bypass Target: Rule 2, 3

Objective

Perform reconnaissance and data gathering using only built-in Windows tools that are not detected by the EDR’s keyword rules.

Scanner Behavior

Rule 2 checks for specific keywords: whoami, net user, net group, etc. Rule 3 checks for additional recon commands but discards the result. Neither rule covers all Windows built-in tools.

Rules

Gather the current username, domain, IP address, and local administrators
Use only built-in Windows tools (no third-party software)
The EDR must not trigger any SUSPICIOUS_CMDLINE detections

Hints

Hint 1

There are many ways to get the same information. whoami is not the only way to find your username.

Hint 2

PowerShell cmdlets like Get-WmiObject, [Environment]::UserName, or Get-LocalGroupMember achieve the same results but aren't in the keyword list.

Hint 3

echo %USERNAME%, set USERNAME, wmic useraccount list brief - none of these contain "whoami" or "net user".