detecting-living-off-the-land-with-lolbas

name	detecting-living-off-the-land-with-lolbas
description	Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis. Use when detecting living off the land binaries (lolbins/lolbas) abuse including certutil,.
domain	cybersecurity
subdomain	threat-detection
tags	["lolbas","lolbins","sigma-rules","process-monitoring","sysmon","endpoint-detection","threat-hunting"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"]

Detecting Living Off the Land with LOLBAS

Overview

Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) are legitimate system utilities abused by attackers to execute malicious actions while evading detection. This skill covers detecting abuse of certutil.exe, regsvr32.exe, mshta.exe, rundll32.exe, msbuild.exe, and other LOLBins using process telemetry from Sysmon and Windows Event Logs, combined with Sigma rule-based detection.

When to Use

Trigger phrases:

• "detecting living off the land with lolbas"

• "Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, r"

• When investigating security incidents that require detecting living off the land with lolbas

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon or Windows Security Event Log (Event ID 4688) with command-line logging enabled
• Sigma rule conversion tool (sigmac or sigma-cli)
• SIEM platform (Splunk, Elastic, or similar) for log ingestion
• Python 3.8+ with pySigma library
• LOLBAS project reference database

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}