detecting-living-off-the-land-attacks

name	detecting-living-off-the-land-attacks
description	Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns. . Use when working with detecting living off the land attacks.
domain	cybersecurity
tags	["lolbins","lotl","fileless-attacks","process-monitoring"]
subdomain	threat-detection
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"]

Detecting Living Off The Land Attacks

Overview

Cybersecurity skill for detecting living off the land attacks. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting living off the land attacks"

• "Detect abuse of legitimate Windows binaries (LOLBins) used for living off the la"

• Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time

• Investigating alerts where legitimate system binaries appear in unexpected execution contexts

• Threat hunting across endpoint telemetry for fileless attack indicators

• Hardening application whitelisting policies (AppLocker, WDAC) to restrict dangerous LOLBin usage

• Creating Sysmon configurations tuned to capture LOLBin-related process creation events

• Responding to incidents where adversaries bypassed AV by using only built-in OS tools

Do not use for blocking all LOLBin execution outright; these are legitimate system tools with valid administrative uses. Detection must focus on anomalous context (parent process, command-line arguments, network activity) rather than binary presence alone.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Sysmon v15+ installed on Windows endpoints with a tuned configuration (SwiftOnSecurity or Olaf Hartong baseline)
• SIEM platform ingesting Sysmon Event IDs 1 (Process Create), 3 (Network Connection), 7 (Image Loaded), 11 (File Create)
• Windows Event Log forwarding for Security Event IDs 4688 (Process Creation with command-line logging enabled)
• LOLBAS project reference: https://lolbas-project.github.io/
• Python 3.8+ with evtx, pandas for offline log analysis
• Sigma rule repository for cross-platform detection rule authoring

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    : ,
    : ,
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}