Detecting Living Off the Land with LOLBAS

Overview

Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) are legitimate system utilities abused by attackers to execute malicious actions while evading detection. This guide covers detecting abuse of certutil.exe, regsvr32.exe, mshta.exe, rundll32.exe, msbuild.exe, and other LOLBins using process telemetry from Sysmon and Windows Event Logs, combined with Sigma rule-based detection.

Prerequisites

• Sysmon or Windows Security Event Log (Event ID 4688) with command-line logging enabled
• Sigma rule conversion tool (sigmac or sigma-cli)
• SIEM platform (Splunk, Elastic, or similar) for log ingestion
• Python 3.8+ with pySigma library
• LOLBAS project reference database

Steps

1. Establish LOLBin Watchlist — Build a prioritized list of monitored binaries (certutil, mshta, regsvr32, rundll32, msbuild, installutil, cmstp, wmic, bitsadmin)
2. Collect Process Telemetry — Ingest Sysmon Event ID 1 (Process Create) and Windows 4688 events with full command-line capture
3. Build Sigma Detection Rules — Create Sigma rules matching suspicious command-line arguments, network activity, and parent-child process anomalies for each LOLBin
4. Analyze Parent-Child Relationships — Flag unexpected parent processes spawning LOLBins (e.g., Excel spawning certutil, Word spawning mshta)
5. Score and Prioritize Alerts — Apply risk scoring based on argument anomaly, parent process, execution path, and network indicators
6. Generate Detection Report — Produce a structured report of all LOLBin abuse detections with MITRE ATT&CK mapping

Expected Output

• JSON report listing detected LOLBin abuse events with severity scores
• MITRE ATT&CK technique mapping for each detection (T1218, T1105, T1140, T1127)
• Parent-child process anomaly analysis
• Sigma rule match details with raw event data

Verification Criteria

Confirm successful execution by validating:

• [ ] All prerequisite tools and access requirements are satisfied
• [ ] Each workflow step completed without errors
• [ ] Output matches expected format and contains expected data
• [ ] No security warnings or misconfigurations detected
• [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC7.1 (Monitoring), CC7.2 (Anomaly Detection)
• ISO 27001: A.12.4 (Logging & Monitoring)
• NIST 800-53: SI-4 (System Monitoring), AU-6 (Audit Review)
• NIST CSF: DE.AE (Anomalies & Events), DE.CM (Continuous Monitoring)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add detecting-living-off-the-land-with-lolbas

# Or load dynamically via MCP
grc.load_skill("detecting-living-off-the-land-with-lolbas")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.