domains / families / security / hunting-for-living-off-the-land-binaries

hunting-for-living-off-the-land-binaries

separate

Proactively hunts for adversary abuse of legitimate, signed system binaries

When to use

• When investigating fileless malware campaigns that bypass traditional AV
• During proactive threat hunts targeting defense evasion techniques
• When EDR alerts fire on legitimate binaries executing unusual child processes
• After threat intelligence reports indicate LOLBin abuse in active campaigns
• During red team/purple team exercises validating detection coverage for T1218

Skill page

Source