<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-living-off-the-land-on-endpoints
description: >-
  Detect abuse of legitimate system binaries (LOLBins) for malicious purposes. Covers LOLBAS catalog, behavioral detection, and parent-child process anomalies.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - lolbins
  - lolbas
  - living-off-the-land
  - behavioral-detection
  - process-monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1218"]
---

# Detecting Living-off-the-Land on Endpoints

## Overview

Living-off-the-land (LOTL) attacks abuse legitimate system utilities to
execute malicious actions. Attackers use trusted binaries like certutil,
mshta, rundll32, and regsvr32 to download payloads, execute code, and evade
detection. LOTL detection requires behavioral analysis rather than signatures.

## Prerequisites

| Requirement | Install |
|---|---|
| Process creation logging | Sysmon EID 1 or Windows EID 4688 |
| SIEM platform | Behavioral rule deployment |
| LOLBAS reference | https://lolbas-project.github.io/ |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Common LOLBins

| Binary | Abuse Type | ATT&CK |
|---|---|---|
| certutil | Download + decode | T1105, T1140 |
| mshta | Script execution | T1218.005 |
| rundll32 | DLL proxy execution | T1218.011 |
| regsvr32 | COM scriptlet execution | T1218.010 |
| wmic | Remote execution | T1047 |
| bitsadmin | Download | T1197 |

### Detection Strategies

- **Command-line anomalies** — certutil with -urlcache, mshta with http://
- **Parent-child anomalies** — Word spawning PowerShell
- **Execution context** — LOLBin from temp/download directories
- **Network activity** — System binaries making outbound connections
- **Frequency analysis** — Rare binary execution on specific endpoint

### Evasion Techniques

- Renaming binaries (copy certutil.exe to cert.exe)
- Using full paths instead of short names
- Chaining multiple LOLBins in sequence
- Using obscure LOLBins not commonly monitored

## Workflow

1. **Enable process logging** — configure Sysmon or EID 4688 with command lines
2. **Catalog LOLBins** — build detection list from LOLBAS project
3. **Build detection rules** — create rules for each LOLBin abuse pattern
4. **Baseline legitimate usage** — document authorized LOLBin usage
5. **Monitor parent-child trees** — alert on anomalous process relationships
6. **Track network connections** — flag LOLBins making outbound connections
7. **Hunt proactively** — search for rare LOLBin executions across fleet


## Detection

```yaml
title: Detect LOLBin Abuse — Suspicious System Binary Network Activity
id: a7b8c9d0-e1f2-3456-abcd-567890123456
status: experimental
description: Detects system binaries (certutil, mshta, bitsadmin) making outbound network connections, a strong indicator of LOLBin abuse.
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\certutil.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
    Initiated: 'true'
  condition: selection
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1218
  - attack.defense_evasion
```

## Verification

| Check | Method |
|---|---|
| Logging active | Process creation events with command lines in SIEM |
| Rules deployed | LOLBin detection rules active for top 10 binaries |
| Baseline documented | Authorized LOLBin usage cataloged per admin team |
| Parent-child alerts | Anomalous process trees trigger detection |
| Network alerts | LOLBin outbound connection generates alert |

## References

- [LOLBAS Project](https://lolbas-project.github.io/)
- [MITRE ATT&CK — T1218](https://attack.mitre.org/techniques/T1218/)
- [Sysmon Configuration](https://github.com/SwiftOnSecurity/sysmon-config)
- [Microsoft — Audit Process Creation](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-process-creation)
