skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-living-off-the-land-with-lolbas

Detect LOLBin abuse via Sysmon telemetry, Sigma rules, and parent-child process analysis.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#threat hunting#sysmon#sigma rules#lolbas#lolbins#endpoint detection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-living-off-the-land-with-lolbas
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-living-off-the-land-with-lolbas
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-detection/detecting-living-off-the-land-with-lolbas
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-living-off-the-land-with-lolbas

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers abuse legitimate Windows utilities like certutil, regsvr32, mshta, and rundll32 to execute malicious actions while evading detection. This Skill provides a structured methodology to detect such Living Off the Land abuse using process telemetry and Sigma rules, closing gaps that simple filename-based matching misses.

Core Features & Use Cases

  • Sigma Rule-Based Detection: Build and convert Sigma rules matching suspicious command-line arguments, network activity, and renamed binaries via OriginalFileName.
  • Parent-Child Anomaly Analysis: Flag unexpected process trees such as Excel spawning certutil or Word spawning mshta.
  • Risk-Scored Reporting: Generate JSON reports with severity scores and MITRE ATT&CK mappings (T1218, T1105, T1140, T1127).
  • Use Case: A SOC analyst investigating a phishing incident uses this Skill to hunt for Squiblydoo-style regsvr32 abuse across Sysmon Event ID 1 logs, validates the rule with Atomic Red Team T1218.010, and produces an ATT&CK-mapped detection report.

Quick Start

Use this skill to hunt for LOLBin abuse in my Sysmon process creation logs and generate a Sigma-rule-based detection report with MITRE ATT&CK mapping.

Frequently Asked Questions about detecting-living-off-the-land-with-lolbas

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect LOLBin abuse like certutil and regsvr32?▼

Detect LOLBin abuse by ingesting Sysmon Event ID 1 or Windows 4688 process creation events with command-line logging, then applying Sigma rules that match suspicious arguments, network activity, and anomalous parent processes such as Office applications spawning these binaries.

How to detect renamed LOLBins that evade filename matching?▼

Match on Sysmon's OriginalFileName or Description fields instead of the Image path, since renaming the binary defeats filename-based rules. Windows Event ID 4688 lacks OriginalFileName, so Sysmon telemetry is required for this detection.

What tools are needed for Sigma rule-based LOLBin detection?▼

You need Sysmon or Windows Security Event Log with command-line auditing, sigma-cli or sigmac for rule conversion, a SIEM such as Splunk or Elastic for ingestion, and Python 3.8+ with the pySigma library.

How do I validate that LOLBin detection rules actually fire?▼

Run Atomic Red Team tests for T1218.010, T1218.011, T1218.005, T1105, and T1127.001, including a renamed-binary test to confirm the rule hits via OriginalFileName. Convert rules with sigma-cli and verify field mappings against your SIEM.

Why do LOLBin detections generate false positives?▼

Installers, SCCM/Intune, and admin tooling legitimately call regsvr32, rundll32, and msiexec. Reduce noise by scoping alerts to anomalous parents like winword, excel, or wscript, flagging LOLBins making outbound connections, and baselining seven days of clean telemetry.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-windows-event-logs-in-splunk

Analyze Windows event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Community
Advanced
daemon-blockint-techdaemon-blockint-tech
7

defensive-security-analyst

Guide alert triage, investigation, and containment planning for SOC operations.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

building-ioc-enrichment-pipeline-with-opencti

Aggregate external threat intelligence to enrich OpenCTI observables with STIX bundles.

Community
Advanced
riparinoriparino
1

defensive-edr-evasion

Detect EDR evasion techniques and map findings to KQL detection patterns.

Community
Advanced