Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
Monitor for suspicious use of legitimate Windows binaries (LOLBins)
including certutil, mshta, rundll32, regsvr32, and others used in
fileless and living-off-the-land attack techniques.
When to Use
Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time
Investigating alerts where legitimate system binaries appear in unexpected execution contexts
Threat hunting across endpoint telemetry for fileless attack indicators
Creating Sysmon configurations tuned to capture LOLBin-related process creation events
Responding to incidents where adversaries bypassed AV by using only built-in OS tools
Do not use for blocking all LOLBin execution outright; these are legitimate system tools with valid administrative uses. Detection must focus on anomalous context (parent process, command-line arguments, network activity) rather than binary presence alone.
Prerequisites
Sysmon v15+ installed on Windows endpoints with a tuned configuration (SwiftOnSecurity or Olaf Hartong baseline)
# Install or update Sysmon with the LOLBin config
sysmon64.exe -accepteula -i sysmon-lolbin-detection.xml
# Update existing Sysmon installation
sysmon64.exe -c sysmon-lolbin-detection.xml
Step 2: Build Sigma Detection Rules for Key LOLBins
Write Sigma rules that detect specific abuse patterns, translatable to any SIEM:
# File: sigma/certutil_download.ymltitle:CertutilUsedtoDownloadFileid:a1b2c3d4-5678-9abc-def0-123456789abcstatus:stabledescription:>
Detects certutil.exe being used to download files from remote URLs,
a common LOLBin technique for payload delivery (LOLBAS T1105).
references:-https://lolbas-project.github.io/lolbas/Binaries/Certutil/-https://attack.mitre.org/techniques/T1105/author:ThreatDetectionTeamdate:2026/01/20logsource:category:process_creationproduct:windowsdetection:selection:Image|endswith:'\certutil.exe'CommandLine|contains|all:-'urlcache'-'-f'-'http'condition:selectionfalsepositives:-LegitimatecertificateenrollmentusingcertutilwithURLparameterslevel:hightags:-attack.defense_evasion-attack.t1218-attack.command_and_control-attack.t1105
# File: sigma/mshta_execution.ymltitle:MSHTAExecutingRemoteorInlineScriptid:b2c3d4e5-6789-abcd-ef01-234567890bcdstatus:stabledescription:>
Detects mshta.exe executing scripts from URLs or inline VBScript/JavaScript,
commonly used for application whitelisting bypass and initial access.
references:-https://lolbas-project.github.io/lolbas/Binaries/Mshta/-https://attack.mitre.org/techniques/T1218/005/logsource:category:process_creationproduct:windowsdetection:selection_remote:Image|endswith:'\mshta.exe'CommandLine|contains:'http'selection_inline:Image|endswith:'\mshta.exe'CommandLine|contains:-'vbscript:'-'javascript:'selection_parent_anomaly:Image|endswith:'\mshta.exe'ParentImage|endswith:-'\winword.exe'-'\excel.exe'-'\outlook.exe'-'\powerpnt.exe'condition:selection_remoteorselection_inlineorselection_parent_anomalyfalsepositives:-LegacyHTA-basedinternalapplicationslevel:high
# File: sigma/regsvr32_scrobj.ymltitle:Regsvr32SquiblydooScriptletExecutionid:c3d4e5f6-7890-bcde-f012-345678901cdestatus:stabledescription:>
Detects regsvr32.exe loading scrobj.dll with a remote scriptlet URL,
known as the Squiblydoo technique for AppLocker bypass.
references:-https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/-https://attack.mitre.org/techniques/T1218/010/logsource:category:process_creationproduct:windowsdetection:selection:Image|endswith:'\regsvr32.exe'CommandLine|contains|all:-'scrobj.dll'-'/i:'condition:selectionfalsepositives:-LegitimateCOMscriptletregistration(rareinmodernenvironments)level:critical
Step 3: Analyze Sysmon Logs for LOLBin Abuse Patterns
Parse and correlate Sysmon events to identify suspicious LOLBin execution:
