hunting-for-living-off-the-land-binaries

name	hunting-for-living-off-the-land-binaries
description	Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection. Use when working with hunting for living off the land binaries.
domain	cybersecurity
tags	["threat-hunting","mitre-attack","lolbins","edr","siem","proactive-detection","defense-evasion"]
subdomain	threat-hunting
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Application Protocol Command Analysis","Content Format Conversion"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-07","ID.RA-05"]

Hunting For Living Off The Land Binaries

Overview

Cybersecurity skill for hunting for living off the land binaries. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting for living off the land binaries"

• "Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to "

• When investigating fileless malware campaigns that bypass traditional AV

• During proactive threat hunts targeting defense evasion techniques

• When EDR alerts fire on legitimate binaries executing unusual child processes

• After threat intelligence reports indicate LOLBin abuse in active campaigns

• During red team/purple team exercises validating detection coverage for T1218

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)
• SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)
• Familiarity with LOLBAS Project (lolbas-project.github.io) reference list
• PowerShell command-line logging enabled (Module Logging, Script Block Logging)
• Network proxy or firewall logs for correlating outbound connections

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}