<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-living-off-the-land-on-endpoints
description: >-
  Detect abuse of legitimate system binaries (LOLBins) for malicious purposes. Covers LOLBAS catalog, behavioral detection, and parent-child process anomalies.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - lolbins
  - lolbas
  - living-off-the-land
  - behavioral-detection
  - process-monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1218"]
---

# Detecting Living-off-the-Land on Endpoints

## Overview

Living-off-the-land (LOTL) attacks abuse legitimate system utilities to
execute malicious actions. Attackers use trusted binaries like certutil,
mshta, rundll32, and regsvr32 to download payloads, execute code, and evade
detection. LOTL detection requires behavioral analysis rather than signatures.

## Prerequisites

| Requirement | Install |
|---|---|
| Process creation logging | Sysmon EID 1 or Windows EID 4688 |
| SIEM platform | Behavioral rule deployment |
| LOLBAS reference | https://lolbas-project.github.io/ |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Common LOLBins

| Binary | Abuse Type | ATT&CK |
|---|---|---|
| certutil | Download + decode | T1105, T1140 |
| mshta | Script execution | T1218.005 |
| rundll32 | DLL proxy execution | T1218.011 |
| regsvr32 | COM scriptlet execution | T1218.010 |
| wmic | Remote execution | T1047 |
| bitsadmin | Download | T1197 |

### Detection Strategies

- **Command-line anomalies** — certutil with -urlcache, mshta with http://
- **Parent-child anomalies** — Word spawning PowerShell
- **Execution context** — LOLBin from temp/download directories
- **Network activity** — System binaries making outbound connections
- **Frequency analysis** — Rare binary execution on specific endpoint

### Evasion Techniques

- Renaming binaries (copy certutil.exe to cert.exe)
- Using full paths instead of short names
- Chaining multiple LOLBins in sequence
- Using obscure LOLBins not commonly monitored

## Workflow

1. **Enable process logging** — configure Sysmon or EID 4688 with command lines
2. **Catalog LOLBins** — build detection list from LOLBAS project
3. **Build detection rules** — create rules for each LOLBin abuse pattern
4. **Baseline legitimate usage** — document authorized LOLBin usage
5. **Monitor parent-child trees** — alert on anomalous process relationships
6. **Track network connections** — flag LOLBins making outbound connections
7. **Hunt proactively** — search for rare LOLBin executions across fleet

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Living Off The Land On Endpoints Detection
id: 09b59927-d2ac-48ab-8ed7-0991777301a6
status: experimental
description: Detects suspicious activity related to detecting living off the land on endpoints techniques in endpoint security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*living*"
  condition: selection
level: medium
tags:
  - attack.t1218
  - attack.execution
falsepositives:
  - Endpoint management software performing routine maintenance tasks
```

## Verification

| Check | Method |
|---|---|
| Logging active | Process creation events with command lines in SIEM |
| Rules deployed | LOLBin detection rules active for top 10 binaries |
| Baseline documented | Authorized LOLBin usage cataloged per admin team |
| Parent-child alerts | Anomalous process trees trigger detection |
| Network alerts | LOLBin outbound connection generates alert |

## References

- [LOLBAS Project](https://lolbas-project.github.io/)
- [MITRE ATT&CK — T1218](https://attack.mitre.org/techniques/T1218/)
- [Sysmon Configuration](https://github.com/SwiftOnSecurity/sysmon-config)
- [Microsoft — Audit Process Creation](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation)
