Detecting Living Off the Land
FreeIdentify abuse of Windows binaries for threat detection.
Free · Opens the source repo
What Detecting Living Off the Land does
Detecting Living Off the Land with LOLBAS is a skill designed for cybersecurity professionals focused on identifying the misuse of legitimate Windows binaries by attackers. This skill leverages process telemetry from Sysmon and Windows Event Logs to detect the abuse of tools such as certutil, regsvr32, mshta, and rundll32. By analyzing parent-child process relationships and applying Sigma rules, security teams can effectively hunt for adversaries who exploit these built-in binaries to execute malicious actions while evading traditional detection methods.
The skill begins with establishing a watchlist of LOLBins that are commonly abused in attacks. It then ingests relevant telemetry data, including Sysmon Event ID 1 and Windows Security Event Log ID 4688, ensuring that command-line logging is enabled to capture the necessary details. With this data, users can create Sigma detection rules that target suspicious command-line arguments and network activities associated with these binaries. Analyzing the parent-child relationships of processes helps identify unexpected behaviors, such as a document spawning a LOLBin, which can indicate malicious intent.
Once potential threats are identified, the skill provides a structured output in JSON format, detailing detected LOLBin abuse events along with severity scores and MITRE ATT&CK technique mappings. This structured reporting aids in prioritizing alerts and understanding the context of each detection, making it a valuable tool for Security Operations Center (SOC) analysts and threat hunters.
Overall, this skill is essential for organizations looking to enhance their endpoint detection capabilities and improve their security monitoring coverage against techniques that leverage legitimate system tools for malicious purposes.
When to use it
Use this skill when investigating security incidents or building detection rules focused on LOLBAS abuse.
When not to use it
This skill may not be suitable for environments without Sysmon or where command-line logging is not enabled.
What you can build with it
Incident Investigation
Use this skill to identify and analyze incidents where LOLBAS may have been exploited by attackers.
Building Detection Rules
Develop Sigma rules tailored to detect suspicious activities involving LOLBins in your environment.
SOC Analyst Support
Provide structured procedures for SOC analysts to validate and enhance monitoring coverage against LOLBAS abuse.
How to install Detecting Living Off the Land
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-living-off-the-land-with-lolbas --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Living Off the Land with LOLBAS
Overview
Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) are legitimate system utilities abused by attackers to execute malicious actions while evading detection. This skill covers detecting abuse of certutil.exe, regsvr32.exe, mshta.exe, rundll32.exe, msbuild.exe, and other LOLBins using process telemetry from Sysmon and Windows Event Logs, combined with Sigma rule-based detection.
When to Use
- When investigating security incidents that require detecting living off the land with lolbas
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Sysmon or Windows Security Event Log (Event ID 4688) with command-line logging enabled
- Sigma rule conversion tool (sigmac or sigma-cli)
- SIEM platform (Splunk, Elastic, or similar) for log ingestion
- Python 3.8+ with pySigma library
- LOLBAS project reference database
Steps
- Establish LOLBin Watchlist — Build a prioritized list of monitored binaries (certutil, mshta, regsvr32, rundll32, msbuild, installutil, cmstp, wmic, bitsadmin)
- Collect Process Telemetry — Ingest Sysmon Event ID 1 (Process Create) and Windows 4688 events with full command-line capture
- Build Sigma Detection Rules — Create Sigma rules matching suspicious command-line arguments, network activity, and parent-child process anomalies for each LOLBin
- Analyze Parent-Child Relationships — Flag unexpected parent processes spawning LOLBins (e.g., Excel spawning certutil, Word spawning mshta)
- Score and Prioritize Alerts — Apply risk scoring based on argument anomaly, parent process, execution path, and network indicators
- Generate Detection Report — Produce a structured report of all LOLBin abuse detections with MITRE ATT&CK mapping
Expected Output
- JSON report listing detected LOLBin abuse events with severity scores
- MITRE ATT&CK technique mapping for each detection (T1218, T1105, T1140, T1127)
- Parent-child process anomaly analysis
- Sigma rule match details with raw event data
Frequently asked questions about Detecting Living Off the Land
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.