skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-lolbins-execution-in-endpoint-logs

Detects malicious abuse of Windows LOLBins by analyzing endpoint process creation logs.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#splunk#sysmon#defense evasion#sigma rules#lolbins#endpoint detection
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-lolbins-execution-in-endpoint-logs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-lolbins-execution-in-endpoint-logs
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-lolbins-execution-in-endpoint-logs
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-lolbins-execution-in-endpoint-logs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Attackers abuse legitimate Windows binaries like certutil, mshta, and regsvr32 to execute payloads while evading detection, and standard keyword rules miss renamed binaries, obfuscated command lines, and long-tail LOLBins. This Skill provides a structured hunt methodology with ready-to-run detection queries to surface that abuse in endpoint telemetry.

Core Features & Use Cases

  • LOLBin Watchlist & Baselining: Build a high-risk binary list from LOLBAS and profile normal command-line arguments, parent processes, and user contexts over 30 days.
  • Ready-to-Run Detection Queries: Includes Splunk SPL, Microsoft Sentinel KQL, and a Sigma rule covering certutil download cradles, mshta remote execution, regsvr32 Squiblydoo, rundll32 proxy execution, and more.
  • Detection Gap Guidance: Documents blind spots such as missing OriginalFileName in Event 4688, caret/quote obfuscation, and disabled command-line auditing, plus validation steps using Atomic Red Team tests.
  • Use Case: A SOC analyst investigating a phishing alert uses the parent-child analysis workflow to discover winword.exe spawning certutil.exe with a -urlcache argument, confirming a weaponized document download cradle.

Quick Start

Hunt my Sysmon process creation logs for suspicious LOLBin executions such as certutil, mshta, rundll32, or regsvr32 with unusual command-line arguments.

Frequently Asked Questions about hunting-for-lolbins-execution-in-endpoint-logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect LOLBin abuse in Windows endpoint logs?▼

Detect LOLBin abuse by hunting Sysmon Event ID 1 or Security Event 4688 for binaries like certutil, mshta, rundll32, and regsvr32 executed with suspicious arguments such as -urlcache, remote URLs, or /s /n /u /i: flags. Correlate with parent processes and network connections to confirm malicious intent.

What are the most commonly abused LOLBins to monitor?▼

The highest-priority LOLBins are certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, cmstp.exe, bitsadmin.exe, wmic.exe, wscript.exe, cscript.exe, and powershell.exe. The LOLBAS project maintains a full reference database of abuse techniques for each binary.

Why does my LOLBin detection rule miss renamed binaries?▼

Security Event 4688 lacks the OriginalFileName field, so a renamed certutil.exe appears only under its new name. Use Sysmon Event ID 1, which logs OriginalFileName and file hashes, to catch renamed LOLBin copies executed from non-standard paths.

Can attackers bypass keyword-based LOLBin detection rules?▼

Yes, attackers defeat literal keyword matching using caret or quote insertion like c^ertu^til, environment variable expansion, and base64-encoded commands. Mitigate this with normalized command-line parsing, regex-based detection, and behavioral parent-child process analysis.

How do I reduce false positives in LOLBin hunting?▼

Reduce false positives by baselining legitimate administrative and installer usage over 30 days before alerting. Filter by parent process, signer, execution path, and frequency, since many LOLBins have valid system administration uses.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
riparinoriparino
1

defensive-threat-intelligence

Enrich and correlate threat intel data to surface actionable indicators for SOC operations.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

av-edr-evasion

Compile custom C and Go payloads to bypass antivirus and EDR detection.

Official
Advanced