hunting-for-living-off-the-land-binaries - Hunting for Living-off-the-Land Binaries (LOLBins)
Proactively hunts for adversary abuse of signed system binaries to execute payloads, download files, or proxy execution.
Tags
Updated: 2026-09-16Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Define hunt hypothesis
- Identify target LOLBins
- Collect process telemetry
- Baseline normal behavior
- Identify execution anomalies
- Correlate telemetry findings
- Document findings and rules
Inputs
- EDR telemetry
- SIEM process creation logs
- LOLBAS Project reference database
- PowerShell logs
- Network proxy and firewall logs
Outputs
- Hunt findings report
- Identified IOC list
- Updated detection rules
Requirements
- Access to EDR telemetry
- Access to SIEM logs
- PowerShell logging enabled