Detecting Endpoint and Ransomware Tradecraft: LOLBins, BYOVD and ESXi

The ransomware kill chain leans on living-off-the-land tradecraft, BYOVD EDR-killers, ESXi lockers and, for initial access, infostealers like Atomic Stealer. Signature detection fails against LOLBins, so this pack is behavioural: baseline normal admin activity and alert on deviation. Rich command-line and script logging is the prerequisite.

Signals at a Glance

Living off the Land

Enable PowerShell script-block logging (4104) and command-line process auditing (4688/Sysmon 1), then alert on dual-use binaries pulling remote content or on Office applications spawning interpreters:

title: LOLBin Download-and-Run (certutil / bitsadmin)
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\certutil.exe'
            - '\bitsadmin.exe'
        CommandLine|contains:
            - 'urlcache'
            - 'http'
            - '/transfer'
    condition: selection
level: high

BYOVD & ESXi

• BYOVD: alert on a kernel driver written to disk and then loaded, cross-reference loaded drivers against the LOLDrivers list, and treat EDR-sensor tamper or sudden telemetry loss as a high-severity precursor to ransomware. Enable Microsoft’s Vulnerable Driver Blocklist and HVCI.
• ESXi: alert on SSH being enabled on a host and on esxcli/vim-cmd commands that power off VMs or delete snapshots outside change windows; forward ESXi syslog off-host and alert when logging is disabled (anti-tamper).
• macOS: alert on osascript presenting password dialogs and on processes other than expected apps reading the login Keychain or browser credential stores.