domains / families / security / hunting-for-lolbins-execution-in-endpoint-logs

hunting-for-lolbins-execution-in-endpoint-logs

separate

Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE

When to use

• When hunting for fileless attack techniques that abuse built-in Windows binaries
• After threat intelligence indicates LOLBin-based campaigns targeting your industry
• When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32
• During purple team exercises testing detection of defense evasion techniques
• When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques

Skill page

Source