Living Off the Land: Detecting LOLBins Before They Detect You

The problem with trusted binaries

LOLBins (living-off-the-land binaries) are legitimate, signed, preinstalled system executables that attackers repurpose for malicious ends. Because the binary is Microsoft-signed and already present, it sails past application allowlists, does not trip antivirus on the file itself, and blends into normal administrative activity.

The technique is not new, but it is dominant. Why drop a custom tool that your EDR might flag when certutil.exe will download a payload for you, mshta.exe will execute a script, and rundll32.exe will run arbitrary code? These abuses map cleanly to MITRE ATT&CK, mostly under T1218 (System Binary Proxy Execution) and T1059 (Command and Scripting Interpreter).

The reference for all of this is the LOLBAS project (lolbas-project.github.io), a community catalog of Windows binaries, scripts, and libraries that can be abused, along with the exact functions each one exposes.

Why signature detection fails

You cannot block certutil.exe. You cannot alert every time rundll32.exe runs, because Windows itself runs it constantly. The binary is not the indicator. The behavior is.

That means three things:

1. File-based detection is useless here. The hash is a legitimate Microsoft file. There is nothing to blocklist.
2. Simple process-name alerts drown you. rundll32.exe and regsvr32.exe fire thousands of times a day in a normal enterprise.
3. Detection lives in the command line and the context. What arguments were passed, what the parent process was, and where the target file lives.

So the work is behavioral. You baseline what legitimate usage looks like, then write logic that catches the deviations.

Baseline before you detect

The single biggest mistake with LOLBin detection is enabling a rule without knowing your environment's normal. Before you write anything, answer:

• Who legitimately runs these binaries? Patch agents, deployment tools, and installers use rundll32 and regsvr32 heavily. Learn their command-line patterns.
• What parents are normal? rundll32 spawned by explorer.exe or an installer is common. rundll32 spawned by winword.exe or powershell.exe is not.
• What paths are normal? DLLs loaded from System32 are expected. A DLL loaded from AppData or Temp is not.

A short baselining hunt against your process-creation logs will show you the top command lines per binary. The long tail, the commands that appear once, on one host, is where abuse hides. This is the same signal-versus-noise discipline that underpins any hunt.

The top LOLBins and how they get abused

Each of these has a legitimate purpose, which is exactly why they are useful to an attacker and hard for you to remove.

Detection idea 1: certutil downloading files

certutil is a certificate utility. It has no business fetching files off the internet, yet -urlcache and -verifyctl do exactly that. The presence of a URL in a certutil command line is close to a smoking gun.

title: Certutil Download or Decode
id: 4f9a2c81-3d6e-4b17-8c22-9e1a5f7b0d34
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\certutil.exe'
    selection_download:
        CommandLine|contains:
            - 'urlcache'
            - 'verifyctl'
    selection_decode:
        CommandLine|contains:
            - 'decode'
            - 'encode'
    condition: selection_img and (selection_download or selection_decode)
falsepositives:
    - Rare legitimate certificate management scripts
level: high
tags:
    - attack.command_and_control
    - attack.t1105
    - attack.t1140

Downloading and base64 decoding are both attacker staples. Legitimate certutil use for these functions is rare enough that this rule runs clean in most environments.

Detection idea 2: regsvr32 Squiblydoo

Squiblydoo abuses regsvr32 to fetch and execute a remote scriptlet through the scrobj.dll COM handler, bypassing many allowlists. The tell is a regsvr32 command referencing a remote script and the scrobj handler.

title: Regsvr32 Remote Scriptlet Execution (Squiblydoo)
id: b2e7f439-6a1c-4e08-9f3b-2c8d5a1e6b70
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains:
            - 'scrobj'
            - '/i:http'
            - '/i:ftp'
    condition: selection
falsepositives:
    - Uncommon legitimate COM registration from network paths
level: high
tags:
    - attack.defense_evasion
    - attack.t1218.010

Detection idea 3: mshta and bitsadmin

mshta.exe executes HTML applications, which can carry VBScript or JScript, so a mshta process that references a remote URL or an inline script protocol is running code, not opening a document. bitsadmin.exe drives the Background Intelligent Transfer Service, and its /transfer verb is a quiet way to pull a payload while looking like a Windows update.

title: Mshta or Bitsadmin Remote Payload
id: e1a83b56-9c47-4d02-8b71-4f6a2d9e3c18
status: stable
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - 'http'
            - 'javascript:'
            - 'vbscript:'
    selection_bits:
        Image|endswith: '\bitsadmin.exe'
        CommandLine|contains: '/transfer'
    condition: selection_mshta or selection_bits
falsepositives:
    - Legacy line-of-business apps that ship HTA files
level: high
tags:
    - attack.defense_evasion
    - attack.t1218.005
    - attack.t1197

Both binaries have thin legitimate use in modern estates, so once you have baselined the handful of legacy apps that rely on them, these fire cleanly.

Detection idea 4: parent-child anomalies

Some LOLBin abuse has command lines that look almost normal. The context is what betrays it. Office applications and script engines spawning system binaries is a strong, generic signal that survives command-line obfuscation.

title: Office App Spawning LOLBin
id: c9d4e2a7-8f13-4b60-9a2e-5c7f1b3d8e46
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
        Image|endswith:
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Some enterprise add-ins; baseline first
level: high
tags:
    - attack.execution
    - attack.t1218

This one rule catches a large slice of phishing-driven execution chains because the delivery document spawns the LOLBin directly.

Tuning: separate admin from adversary

The rules above will produce false positives in some environments. That is normal and it is the point. Tune them with structured allowlisting, not by deleting the rule.

• Exclude known-good parents. If your deployment tool legitimately drives rundll32, exclude that specific parent and command pattern, not the whole binary.
• Exclude known-good paths. Whitelist the specific DLL or script paths your software uses, then anything outside them stays suspicious.
• Watch the exclusion list. Every exclusion is a hole an attacker could hide in. Keep them specific and review them.

Author and validate this logic before it ships. A workbench like hunt.mlab.sh lets you write Sigma, check the syntax, convert it to your SIEM's query language, and see how the rule maps against ATT&CK coverage, so you know which LOLBin techniques you can now see and which you still cannot.

When a LOLBin command line references a domain or IP, extract it and enrich. A quick lookup on mlab.sh turns "certutil hit some URL" into "certutil hit a known malware distribution host," which changes how fast you respond.

Closing

LOLBins win by hiding inside the tools you trust and cannot remove. You beat them by shifting your attention from the file to the behavior: the arguments, the parent, the path. Baseline hard, write behavioral logic, tune with precision, and the trusted binary that was invisible becomes one of the loudest signals you have.

You cannot uninstall certutil. You can absolutely watch what it does.