domains / families / security / detecting-living-off-the-land-attacks

detecting-living-off-the-land-attacks

separate

'Detect abuse of legitimate Windows binaries (LOLBins) used for living

When to use

• Building detection rules for SIEM or EDR platforms to catch LOLBin abuse in real time
• Investigating alerts where legitimate system binaries appear in unexpected execution contexts
• Threat hunting across endpoint telemetry for fileless attack indicators
• Hardening application whitelisting policies (AppLocker, WDAC) to restrict dangerous LOLBin usage
• Creating Sysmon configurations tuned to capture LOLBin-related process creation events
• Responding to incidents where adversaries bypassed AV by using only built-in OS tools

When not to use

• Blocking all LOLBin execution outright

Skill page

Source