Detecting LOLBins: Living-off-the-Land Binary Abuse

Living-off-the-land binaries are legitimate, signed Windows utilities that can download, decode, execute or proxy code. Blocking them outright usually breaks something, so detection has to be specific: which arguments, from which parent, with which network or file side effects. The LOLBAS project catalogues the abuses; the job is to turn that catalogue into tuned, tiered detections.

Signals at a Glance

Arguments, Parents and Network

Start with a tight, high-fidelity set. Each of these usages is rare for a human administrator and common for malware. This query covers the four binaries in one pass; split it into separate rules when you tune:

// Microsoft Defender XDR (KQL) - high-signal LOLBin argument patterns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "certutil.exe"
         and ProcessCommandLine has_any ("-urlcache", "-verifyctl", "-decode", "-decodehex", "-encode"))
    or (FileName =~ "mshta.exe"
         and ProcessCommandLine matches regex @"(?i)(https?://|javascript:|vbscript:)")
    or (FileName =~ "bitsadmin.exe"
         and ProcessCommandLine has_any ("/transfer", "/addfile", "/SetNotifyCmdLine"))
    or (FileName =~ "msiexec.exe"
         and ProcessCommandLine matches regex @"(?i)\s/[iqjy].*https?://")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
// tune/validate: software deployment tooling uses msiexec and bitsadmin the same way.

Argument matching alone misses renamed binaries and reordered flags, so add a rarity layer. In Splunk, rank command lines by how few hosts ever run them:

index=sysmon EventCode=1 (OriginalFileName IN ("CertUtil.exe","MSHTA.EXE","bitsadmin.exe","msiexec.exe"))
| eval exe=lower(OriginalFileName)
| stats count dc(host) as hosts values(ParentImage) as parents by exe, CommandLine
| where hosts <= 2 AND count < 5
| sort - count
`comment("tune/validate: OriginalFileName catches renamed copies; review parents first")`

Context That Separates Abuse

• Use OriginalFileName from the PE header, not the file name, so renamed copies of certutil or mshta still match.
• Escalate when the parent is winword.exe, excel.exe, outlook.exe, a browser or wscript.exe; legitimate administration rarely starts from those.
• Join Sysmon Event 3 to find LOLBins that open outbound connections, especially mshta.exe and certutil.exe from workstations.
• Prioritise by LOLBAS category: download and execute capabilities deserve alerts; read-only capabilities may belong in hunting queries only.
• Pair detections with application control or ASR rules that block the worst offenders outright where the business allows.