sica-fondt/knowledge/cyber-skills/skills/hunting-for-living-off-the-land-binaries/references/workflows.md

Detailed Hunting Workflow - LOLBins

Phase 1: Intelligence Gathering

Step 1.1 - Review Current Threat Landscape

• Check LOLBAS Project for newly added binaries
• Review threat intel feeds for active campaigns abusing LOLBins
• Correlate with CISA advisories and vendor threat reports
• Identify LOLBins relevant to your environment's OS versions

Step 1.2 - Prioritize Target LOLBins

• Rank LOLBins by prevalence in current threat campaigns
• Consider which LOLBins have no existing detection rules
• Focus on LOLBins with download, execute, and encode capabilities
• Map to MITRE ATT&CK navigator for coverage gaps

Phase 2: Data Collection

Step 2.1 - Sysmon Process Creation Query (Event ID 1)

EventID=1 AND (
  Image CONTAINS "certutil.exe" OR
  Image CONTAINS "mshta.exe" OR
  Image CONTAINS "rundll32.exe" OR
  Image CONTAINS "regsvr32.exe" OR
  Image CONTAINS "msiexec.exe" OR
  Image CONTAINS "cmstp.exe" OR
  Image CONTAINS "wmic.exe" OR
  Image CONTAINS "bitsadmin.exe" OR
  Image CONTAINS "msbuild.exe"
)

Step 2.2 - Splunk SPL Query for LOLBin Network Activity

index=sysmon EventCode=3
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32|msiexec|bitsadmin)\.exe$")
| stats count by Image, DestinationIp, DestinationPort, User
| where DestinationIp!="10.*" AND DestinationIp!="172.16.*" AND DestinationIp!="192.168.*"
| sort -count

Step 2.3 - KQL Query for Microsoft Defender for Endpoint

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("certutil.exe","mshta.exe","rundll32.exe","regsvr32.exe","bitsadmin.exe","cmstp.exe")
| where ProcessCommandLine has_any ("http","ftp","urlcache","-decode","/i:","scrobj.dll","-enc")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Phase 3: Baseline Analysis

Step 3.1 - Establish Normal Usage Patterns

• Count daily executions per LOLBin per endpoint
• Document standard parent processes (explorer.exe -> certutil.exe for IT admin)
• Record typical command-line arguments for legitimate use
• Note time-of-day patterns (business hours vs. off-hours)

Step 3.2 - Build Frequency Analysis

index=sysmon EventCode=1
| where match(Image, "(?i)(certutil|mshta|rundll32)\.exe$")
| timechart span=1h count by Image
| eventstats avg(certutil.exe) as avg_certutil, stdev(certutil.exe) as stdev_certutil
| where certutil.exe > (avg_certutil + 3*stdev_certutil)

Phase 4: Anomaly Detection

Step 4.1 - Suspicious Command-Line Indicators

LOLBin	Suspicious Argument	Reason
certutil.exe	-urlcache -split -f	Remote file download
certutil.exe	-encode / -decode	Data encoding/obfuscation
mshta.exe	javascript: or vbscript:	Inline script execution
regsvr32.exe	/s /n /u /i:http	Remote SCT execution (Squiblydoo)
rundll32.exe	javascript:	Script execution proxy
bitsadmin.exe	/transfer with URL	File download
msiexec.exe	/q /i http://	Silent remote MSI install
cmstp.exe	/s /ns with INF file	UAC bypass

Step 4.2 - Anomalous Parent-Child Relationships

Flag when these parent processes spawn LOLBins:

• winword.exe -> certutil.exe (document downloading payload)
• outlook.exe -> mshta.exe (email launching HTA)
• wmiprvse.exe -> rundll32.exe (WMI lateral movement)
• svchost.exe -> regsvr32.exe (service spawning proxy execution)

Phase 5: Correlation and Enrichment

Step 5.1 - Network Correlation

• Match LOLBin network connections to threat intel domain/IP lists
• Check destination IPs against VirusTotal, AbuseIPDB
• Verify if domains are newly registered (DGA detection)
• Correlate with DNS query logs for suspicious resolutions

Step 5.2 - File Activity Correlation

• Track files created by LOLBin processes
• Check file hashes against threat intel feeds
• Monitor for files written to unusual directories (Temp, AppData, ProgramData)
• Look for ADS (Alternate Data Streams) usage

Phase 6: Documentation and Response

Step 6.1 - Document Findings

• Record all true positive findings with evidence
• Document false positive patterns for tuning
• Update detection analytics with new signatures
• Create IOC lists for identified threats

Step 6.2 - Update Detection Coverage

• Write or update Sigma rules for identified patterns
• Deploy new EDR detection rules
• Update SIEM correlation rules
• Add findings to MITRE ATT&CK Navigator heatmap