Hunting for LOLBins Execution in Endpoint Logs

When to Use

• When hunting for fileless attack techniques that abuse built-in Windows binaries
• After threat intelligence indicates LOLBin-based campaigns targeting your industry
• When investigating alerts for suspicious use of certutil, mshta, rundll32, or regsvr32
• During purple team exercises testing detection of defense evasion techniques
• When assessing endpoint detection coverage for MITRE ATT&CK T1218 sub-techniques

Prerequisites

• Sysmon Event ID 1 (Process Creation) with full command-line logging
• Windows Security Event ID 4688 with command-line auditing enabled
• EDR telemetry with parent-child process relationships
• SIEM platform for query and correlation (Splunk, Elastic, Microsoft Sentinel)
• LOLBAS project reference (lolbas-project.github.io) for known abuse patterns

Workflow