SOP-24: LOLBin / Living-off-the-Land Abuse Response

SOC analyst playbook for detecting and responding to LOLBin / LOLBAS abuse. Covers certutil, mshta, regsvr32, rundll32, mavinject, msbuild, odbcconf. Portal navigation for MDE Device Timeline. KQL for Sentinel, SPL for Splunk.