What are living-off-the-land binaries (LOLBins), and how would you hunt for their abuse?

Living-off-the-land binaries — LOLBins — are the attacker's way of hiding in plain sight. They are legitimate, signed, Microsoft-shipped (or otherwise pre-installed) tools repurposed for malicious ends. Because the binary is trusted, traditional file-based controls wave it through.

Common offenders

certutil (download/encode), bitsadmin (download/persistence), mshta and rundll32 and regsvr32 (proxy execution), wmic (execution/lateral movement), powershell and cmd, msbuild, installutil. The LOLBAS project catalogs these and the techniques they enable. ATT&CK groups much of this under signed binary proxy execution (T1218).

Why the file is the wrong thing to detect

The executable is genuine and often allowlisted, so hash- or signature-based detection is useless. You must detect on how it is being used.

Where the signal lives

• Command line — certutil -urlcache -f http://... or base64-decoding arguments are far outside normal admin use. Full command-line logging is essential.
• Parent process — winword.exe or mshta.exe spawning powershell.exe is anomalous; a benign certutil is rarely launched by an Office app.
• Network behaviour — certutil or bitsadmin making outbound connections to non-corporate hosts is a strong tell.
• Path and user — execution from temp/user-writable directories or by accounts that never run these tools.

Hunting approach

Baseline normal usage of each binary, then hunt for the deviations above. Promote durable findings into Sigma rules tagged to T1218.

Why this matters

Senior interviewers expect you to know that the binary is trusted, so detection is behavioural — command line, lineage, and network — and that command-line visibility is the prerequisite.