agentsclimarketplace
Sign in

Hunting lolbin abuse on windows

Skill meltedinhex/analyst-ai-pack/skills/hunting-lolbin-abuse-on-windows

Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creation telemetry by flagging trusted system binaries used with download, execution-proxy, or encoded-command arguments. Activates for requests to hunt LOLBins, detect signed-binary proxy execution, or find suspicious certutil/mshta/regsvr32 usage.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-lolbin-abuse-on-windows

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 453 tokens by cl100k_base, as published. Nobody here has run it

Hunting LOLBin Abuse on Windows

When to Use

  • You have process-creation telemetry (Sysmon Event ID 1 or EDR process events as CSV/JSON) and want to surface trusted binaries used for malicious proxy execution or download.
  • You are building a detection from known LOLBin argument patterns.

Do not use this as a blocklist of the binaries themselves — they are legitimate. Hunt on the suspicious argument/parent context, not mere presence.

Prerequisites

  • Process-creation events with image path, command line, and (ideally) parent image.

Workflow

Step 1: Score LOLBin invocations

python scripts/analyst.py hunt events.csv

Flags known LOLBins (certutil, mshta, regsvr32, rundll32, bitsadmin, msiexec, installutil, wmic) paired with suspicious arguments (-urlcache, http, javascript:, scrobj, -decode, DownloadString).

Step 2: Add context

Weight by anomalous parent (Office, browser, script host) and unusual execution path.

Step 3: Triage and confirm

Investigate the top-scoring events; confirm whether the download/proxy behavior is legitimate administration or malicious.

Step 4: Operationalize

Convert confirmed patterns into a Sigma rule for ongoing detection.

Validation

  • Flags require a suspicious argument/parent, not just the binary name.
  • Known-benign administrative patterns are distinguishable from abuse in the output.
  • Each flagged technique maps to an ATT&CK ID (T1218.x / T1105).

Pitfalls

  • Alerting on rundll32/regsvr32 presence alone — extremely noisy.
  • Missing renamed LOLBins (hash/signature checks help, name checks do not).
  • Encoded-command obfuscation hiding the true argument intent.

References

What ships with it: 3 files

4.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.