Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
Instrucciones de origen · Vista previa de solo lectura
name
detecting-living-off-the-land-attacks
description
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
Monitor for suspicious use of legitimate Windows binaries (LOLBins)
including certutil, mshta, rundll32, regsvr32, and others used in
fileless and living-off-the-land attack techniques.
When to Use
Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time
Investigating alerts where legitimate system binaries appear in unexpected execution contexts
Threat hunting across endpoint telemetry for fileless attack indicators
Creating Sysmon configurations tuned to capture LOLBin-related process creation events
Responding to incidents where adversaries bypassed AV by using only built-in OS tools
Do not use for blocking all LOLBin execution outright; these are legitimate system tools with valid administrative uses. Detection must focus on anomalous context (parent process, command-line arguments, network activity) rather than binary presence alone.
Detection Gaps & Validation
Variants most often missed: rules matching on Image|endswith: '\rundll32.exe' miss renamed binaries (svchost1.exe copied from rundll32) — pivot to Sysmon OriginalFileName (EID 1) / Description, because Windows Security EID 4688 carries no OriginalFileName field and is trivially defeated by renaming. Also missed: signed-proxy execution variants — rundll32 javascript:"\..\mshtml...", regsvr32 /s /n /u /i:http://...scrobj.dll (Squiblydoo), mshta vbscript:Execute(...), and certutil -urlcache/-decode for staging.
False negatives: LOLBin via COM/WMI (wmic ... /format:http://...xsl), DLL execution by ordinal (rundll32 evil.dll,#1), and proxy execution where the malicious child is launched by a benign-looking signed parent. Argument obfuscation (caret/quote insertion, env-var expansion %comspec%) defeats literal command-line substring matches.
Validate the rule fires: Atomic Red Team T1218.010 (regsvr32 Squiblydoo), T1218.011 (rundll32), T1218.005 (mshta), T1105 (certutil download). Run the renamed-binary case and confirm detection survives on OriginalFileName, not Image.
FP tuning: baseline legitimate callers — software installers, SCCM/Intune, and admin scripts legitimately invoke rundll32/regsvr32/msiexec; scope by parent process (alert on Office// parents) and outbound network from the LOLBin rather than execution alone.
wscript
explorer
Prerequisites
Sysmon v15+ installed on Windows endpoints with a tuned configuration (SwiftOnSecurity or Olaf Hartong baseline)
# Install or update Sysmon with the LOLBin config
sysmon64.exe -accepteula -i sysmon-lolbin-detection.xml
# Update existing Sysmon installation
sysmon64.exe -c sysmon-lolbin-detection.xml
Step 2: Build Sigma Detection Rules for Key LOLBins
Write Sigma rules that detect specific abuse patterns, translatable to any SIEM:
# File: sigma/certutil_download.ymltitle:CertutilUsedtoDownloadFileid:a1b2c3d4-5678-9abc-def0-123456789abcstatus:stabledescription:>
Detects certutil.exe being used to download files from remote URLs,
a common LOLBin technique for payload delivery (LOLBAS T1105).
references:-https://lolbas-project.github.io/lolbas/Binaries/Certutil/-https://attack.mitre.org/techniques/T1105/author:ThreatDetectionTeamdate:2026/01/20logsource:category:process_creationproduct:windowsdetection:selection:Image|endswith:'\certutil.exe'CommandLine|contains|all:-'urlcache'-'-f'-'http'condition:selectionfalsepositives:-LegitimatecertificateenrollmentusingcertutilwithURLparameterslevel:hightags:-attack.defense_evasion-attack.t1218-attack.command_and_control-attack.t1105
# File: sigma/mshta_execution.ymltitle:MSHTAExecutingRemoteorInlineScriptid:b2c3d4e5-6789-abcd-ef01-234567890bcdstatus:stabledescription:>
Detects mshta.exe executing scripts from URLs or inline VBScript/JavaScript,
commonly used for application whitelisting bypass and initial access.
references:-https://lolbas-project.github.io/lolbas/Binaries/Mshta/-https://attack.mitre.org/techniques/T1218/005/logsource:category:process_creationproduct:windowsdetection:selection_remote:Image|endswith:'\mshta.exe'CommandLine|contains:'http'selection_inline:Image|endswith:'\mshta.exe'CommandLine|contains:-'vbscript:'-'javascript:'selection_parent_anomaly:Image|endswith:'\mshta.exe'ParentImage|endswith:-'\winword.exe'-'\excel.exe'-'\outlook.exe'-'\powerpnt.exe'condition:selection_remoteorselection_inlineorselection_parent_anomalyfalsepositives:-LegacyHTA-basedinternalapplicationslevel:high
# File: sigma/regsvr32_scrobj.ymltitle:Regsvr32SquiblydooScriptletExecutionid:c3d4e5f6-7890-bcde-f012-345678901cdestatus:stabledescription:>
Detects regsvr32.exe loading scrobj.dll with a remote scriptlet URL,
known as the Squiblydoo technique for AppLocker bypass.
references:-https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/-https://attack.mitre.org/techniques/T1218/010/logsource:category:process_creationproduct:windowsdetection:selection:Image|endswith:'\regsvr32.exe'CommandLine|contains|all:-'scrobj.dll'-'/i:'condition:selectionfalsepositives:-LegitimateCOMscriptletregistration(rareinmodernenvironments)level:critical
Step 3: Analyze Sysmon Logs for LOLBin Abuse Patterns
Parse and correlate Sysmon events to identify suspicious LOLBin execution:
