What problem does it solve?
Attackers increasingly abuse legitimate Windows binaries like certutil, mshta, rundll32, and regsvr32 to execute payloads, download malware, and bypass application whitelisting without dropping obvious malicious files. Traditional signature-based detection misses these living-off-the-land techniques because the binaries themselves are trusted system tools, leaving security teams blind to fileless attacks.
Core Features & Use Cases
- Sysmon Configuration for LOLBin Telemetry: Deploy a tuned Sysmon config capturing process creation and network connection events for over 25 known LOLBins.
- Sigma Detection Rules: Ready-to-convert Sigma rules for certutil downloads, mshta remote script execution, and regsvr32 Squiblydoo attacks, translatable to any SIEM.
- Behavioral Analysis Scripts: Python analyzers that flag suspicious command-line patterns, LOLBin outbound network connections, and anomalous parent-child relationships such as Office applications spawning script interpreters.
- Use Case: A SOC analyst investigating an alert where winword.exe spawned certutil.exe can use the parent-child anomaly detection and command-line pattern matching to confirm a macro-based payload download, then validate coverage with Atomic Red Team tests for T1218.
Quick Start
Ask the AI to build Sigma detection rules and a Sysmon configuration that catch certutil, mshta, and rundll32 abuse on your Windows endpoints.
