How to detect living-off-the-land binary (LOLBin) abuse

Threat snapshot

Living-off-the-land binaries are the attacker's answer to application whitelisting. When an endpoint security control blocks unknown executables, attackers pivot to trusted Windows system binaries that are already present on every host, signed by Microsoft, and permitted by default application control policies. These binaries were built for legitimate administrative purposes: certutil.exe for certificate management, mshta.exe for running HTML applications, rundll32.exe for loading DLL functions, msiexec.exe for installing software. Their legitimate use gives attackers cover. Their ubiquity means no additional tooling needs to be dropped on the host.

The detection challenge is distinguishing the legitimate administrative use of these tools from their abuse. certutil.exe decoding a Base64-encoded certificate is normal. certutil.exe decoding a Base64-encoded PE file dropped in a temp directory is not. mshta.exe rendering a local HTA file during a software installation is normal. mshta.exe loading a remote HTA file from an attacker-controlled web server is not. The difference is in the arguments, the parent process, and the context of execution, all of which are visible in process creation logs.

Log360 maps 174 detection rules to LOLBin abuse across a wide range of system utilities. The coverage spans the most commonly abused binaries: mshta.exe, rundll32.exe, certutil.exe, msiexec.exe, regsvr32.exe, cmstp.exe, installutil.exe, and many lesser-known utilities that have been documented as LOLBins in public threat intelligence. This page covers the primary abuse techniques, the specific rules that detect them, and how to investigate when they fire.

LOLBin detection, at a glance

How LOLBin abuse works

Certutil: certificate tool repurposed for file download and decoding

Certutil.exe is designed for certificate store management, but its -urlcache and -decode flags make it a capable file downloader and Base64 decoder. Attackers use certutil -urlcache -split -f [URL] to download files from attacker-controlled servers using a trusted Microsoft binary, bypassing download reputation controls that block unknown executables. They also use certutil -decode to decode Base64-encoded payloads that were dropped to disk, avoiding the need to drop a decoded binary directly. Log360 detects these through Uncommon Network Connection Initiated By Certutil.EXE, File Decoded From Base64/Hex Via Certutil.EXE, File Encoded To Base64 Via Certutil.EXE, and File In Suspicious Location Encoded To Base64 Via Certutil.EXE.

Rundll32: DLL loader abused for arbitrary code execution

Rundll32.exe loads and executes DLL functions, which makes it useful for running arbitrary code contained in a DLL without creating a new process for the DLL itself. Attackers use it to execute Cobalt Strike beacons packaged as DLLs, load malicious DLLs from unusual paths, and invoke DLL functions by ordinal number rather than name to obscure what is being loaded. The CobaltStrike Load by Rundll32 and DLL Call by Ordinal Via Rundll32.EXE rules target these specific patterns. The HackTool - F-Secure C3 Load by Rundll32 rule catches the F-Secure C3 framework, which is used by red teamers and has been observed in real-world attacks.

MSHTA: HTML application host used to execute scripts

Mshta.exe is the Windows host for HTML Application (.hta) files, which can contain VBScript or JScript with full Windows API access. Attackers use mshta.exe to execute remote HTA files containing malicious scripts, bypassing script file execution controls because mshta.exe is trusted. The most damaging variant is Office applications spawning mshta.exe, which indicates a malicious Office document macro or exploit delivered the mshta execution. Office Product Spawning MSHTA (Critical) targets this parent-child relationship specifically.

CMSTP: connection manager profile installer used for UAC bypass and code execution

CMSTP.exe installs Connection Manager service profiles and can be coerced into auto-elevating and executing arbitrary INF scripts, making it a UAC bypass mechanism. It was used in several high-profile campaigns including by MuddyWater. Log360 detects CMSTP execution through CMSTP Execution Process Creation, CMSTP Execution Registry Event, DLL Loaded From Suspicious Location Via Cmspt.EXE, and Bypass UAC via CMSTP.

Regasm and Regsvcs: .NET registration tools for code execution

Regasm.exe and Regsvcs.exe register .NET assemblies for COM interoperability but will execute code in a [ComRegisterFunction] annotated method within the assembly during registration. Attackers package malicious .NET code in an assembly and register it via Regasm or Regsvcs to execute it with potential privilege escalation. Detect Regasm Spawning a Process (Critical) and Possible DLL Injection by Regasm activity (Critical) target this pattern.

Less common LOLBins: desktopimgdownldr, squirrel, extrac32, findstr

A long tail of less commonly known Windows binaries have been documented as LOLBins. Desktopimgdownldr.exe, normally used to download desktop images for lock screens, can download arbitrary files. Squirrel.exe, part of the Electron application update framework, can download and execute arbitrary payloads. Extrac32.exe, a cabinet extraction tool, can extract arbitrary files from CAB archives including downloaded ones. Findstr.exe can download remote files from UNC paths. Log360 has dedicated rules for each of these less common LOLBin download vectors.

Real-world campaigns

MuddyWater: CMSTP for UAC bypass and persistence

MuddyWater, an Iranian APT group, used CMSTP.exe extensively for UAC bypass and to execute malicious INF scripts as part of their initial access and persistence chain. Their operations generated the specific CMSTP process creation and registry event patterns that Log360's CMSTP rules target.

APT32: Rundll32 for beacon loading

APT32 (OceanLotus) used Rundll32.exe to load their custom backdoor DLLs, packaging their implants as DLLs and invoking them through Rundll32 to avoid creating additional suspicious process names. The DLL Call by Ordinal Via Rundll32.EXE rule catches their ordinal-based invocation pattern.

IcedID and Gootloader: LOLBin for payload delivery

IcedID and Gootloader malware families use LOLBins extensively in their delivery chains. IcedID has been specifically observed using Rundll32 with single-digit DLL ordinals (e.g., rundll32.exe malware.dll,#1), which is detected by the IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32 rule. Gootloader uses mshta.exe in its execution chain to bypass script execution controls.

Business impact

• Application whitelisting provides no protection against LOLBin abuse. All LOLBins are trusted system binaries: Standard application control policies that block unknown executables specifically permit these tools. SIEM-based behavioral detection is the primary control layer that remains effective.
• LOLBin abuse leaves a lighter footprint than dropper-based attacks: Because no additional executable is introduced to the host, traditional forensic artifacts like new file creation in suspicious directories are absent. The entire attack chain may run through existing system binaries.
• The long tail of less common LOLBins makes manual awareness impractical: Security teams cannot realistically memorize the hundreds of documented LOLBins and their abuse patterns. Rule-based detection that covers the full documented library is the only scalable approach.

Detecting LOLBin abuse with Log360

LOLBin detection relies entirely on process creation event logging. Windows Security Event 4688 must be enabled with full command-line capture. Sysmon Event 1 with command-line logging provides equivalent coverage and is preferred in environments where Sysmon is deployed. Without command-line capture, most LOLBin abuse rules cannot fire because the binary name alone is insufficient to distinguish legitimate from malicious use.

Investigation playbook

Step 1: Identify the abuse pattern and the payload

• For every LOLBin alert, examine the full command line from the process creation event. The arguments tell you what the LOLBin is actually doing. A certutil -urlcache event should be followed immediately by examining the downloaded file path and checking whether that file was subsequently executed.
• Identify the parent process that launched the LOLBin. LOLBins launched by Office applications (Office Product Spawning MSHTA), script hosts (wscript.exe, cscript.exe), or other LOLBins create a chained execution pattern that is a strong indicator of an automated attack rather than an administrator action.
• For download-related LOLBins, correlate with network logs to identify the download source IP and domain. Block the destination immediately and query network logs for other internal hosts that have connected to the same destination.

Step 2: Check for subsequent execution

• Query process creation events on the same host for 30 minutes following the LOLBin event. If the LOLBin was used to download or decode a payload, the payload execution should appear as a subsequent process creation event. Identify the spawned process and determine whether it matches known malware patterns.
• Check whether any persistence mechanisms (scheduled tasks, registry run keys, service installations) were created in the period following the LOLBin event. LOLBin abuse is often part of a delivery and persistence chain rather than a standalone event.

Response and remediation

Immediate actions

• For Critical severity LOLBin alerts (Office Product Spawning MSHTA, Detect Regasm Spawning a Process), isolate the host immediately: These combinations represent high-confidence active compromise. The time between a malicious macro spawning mshta.exe and a C2 beacon establishing persistence can be under 60 seconds.
• Block LOLBin network access at the host firewall level where legitimate business use does not require internet connectivity: Certutil.exe, mshta.exe, and several other LOLBins have no legitimate reason to initiate outbound internet connections in most enterprise environments. Host-based firewall rules blocking outbound connections from these binaries eliminate the download cradle abuse vector while preserving their local administrative functionality.