Living Off the Land (LOLBins) Detection FAQs

Question 1

Is this compatible with my SIEM?

Accepted Answer

Yes, the skill includes Sigma rules which are a vendor-neutral format that can be translated into queries for Splunk, ELK, Microsoft Sentinel, and other major SIEM platforms.

Question 2

What are Living Off the Land (LotL) attacks?

Accepted Answer

LotL attacks involve adversaries using legitimate, pre-installed system tools (LOLBins) to perform malicious actions, allowing them to blend in with normal administrative activity and bypass traditional antivirus.

Question 3

What logs are required for this skill to work?

Accepted Answer

It primarily utilizes Sysmon Event IDs (1, 3, 7, 11) and Windows Security Event ID 4688 with command-line logging enabled.

Question 4

Which binaries does this skill monitor?

Accepted Answer

It focuses on commonly abused Windows binaries including certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, and powershell.exe, among others.

Question 5

Can I use this for real-time blocking?

Accepted Answer

While possible, it is recommended for detection and monitoring rather than outright blocking, as these tools have valid administrative uses. Detection focuses on anomalous command-line arguments and parent processes.

Living Off the Land (LOLBins) Detection

Key Features

Use Cases

Living Off the Land (LOLBins) Detection

Key Features

Use Cases