Cases Skills About

hunting-for-living-off-the-land-binaries - Hunting for Living-off-the-Land Binaries (LOLBins)

Proactively hunts for adversary abuse of signed system binaries (LOLBins) used to execute payloads, download files, or proxy execution.

Tags

Updated: 2026-09-16

threat-hunting mitre-attack lolbins edr siem proactive-detection defense-evasion

Capabilities

Define hunt hypothesis Identify target LOLBins Collect process telemetry Baseline normal behavior

Typical Inputs

EDR telemetry SIEM process creation logs LOLBAS Project database

Typical Outputs

Threat hunt report Identified anomalies and evidence Indicators of compromise list

What this skill does

Define hunt hypothesis
Identify target LOLBins
Collect process telemetry
Baseline normal behavior
Identify execution anomalies
Correlate and enrich telemetry
Document findings and report

Inputs

EDR telemetry
SIEM process creation logs
LOLBAS Project database
PowerShell command-line logs
Network proxy and firewall logs

Outputs

Threat hunt report
Identified anomalies and evidence
Indicators of compromise list
New or updated detection rules

Requirements

Access to EDR telemetry
Access to SIEM process creation logs
PowerShell logging enabled

Source

Spec: SKILL.md

ClawIndex

OpenClaw Skills & Use Case Index

ClawIndex is an ecosystem-driven index of OpenClaw skills and real-world use cases.

Index

Meta

© 2026 ClawIndex All Rights Reserved.