본문으로 건너뛰기
cccskills
무료GitHub에 공개

detecting-living-off-the-land-with-lolbas

Detect attacks that misuse legitimate Windows utilities such as certutil and mshta. Analyze process logs, command arguments, and parent-child relationships with Sigma detection rules, then report suspicious events with severity scores and supporting event details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32 via process telemetry, Sigma rules, and parent-child process analysis with Sysmon endpoint data. Use when hunting for adversaries abusing built-in Windows binaries to download, execute, or proxy malicious code while evading traditional executable-based detection.

mukul975/Anthropic-Cybersecurity-Skills

실행 점수 미검증

설치 방법 보기

이럴 때 유용합니다

  • Investigating suspicious use of built-in Windows utilities
  • Creating Sigma rules for unusual command arguments
  • Finding Office apps that launch unexpected system utilities
  • Prioritizing detections by risk and supporting evidence

포함된 파일(4)

  • SKILL.md3.1 KB
  • LICENSE11.0 KB
  • references/api-reference.md2.1 KB
  • scripts/agent.py6.8 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Detecting Living Off the Land with LOLBAS

Overview

Living Off the Land Binaries, Scripts, and Libraries (LOLBAS) are legitimate system utilities abused by attackers to execute malicious actions while evading detection. This skill covers detecting abuse of certutil.exe, regsvr32.exe, mshta.exe, rundll32.exe, msbuild.exe, and other LOLBins using process telemetry from Sysmon and Windows Event Logs, combined with Sigma rule-based detection.

When to Use

  • When investigating security incidents that require detecting living off the land with lolbas
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Sysmon or Windows Security Event Log (Event ID 4688) with command-line logging enabled
  • Sigma rule conversion tool (sigmac or sigma-cli)
  • SIEM platform (Splunk, Elastic, or similar) for log ingestion
  • Python 3.8+ with pySigma library
  • LOLBAS project reference database

Steps

  1. Establish LOLBin Watchlist — Build a prioritized list of monitored binaries (certutil, mshta, regsvr32, rundll32, msbuild, installutil, cmstp, wmic, bitsadmin)
  2. Collect Process Telemetry — Ingest Sysmon Event ID 1 (Process Create) and Windows 4688 events with full command-line capture
  3. Build Sigma Detection Rules — Create Sigma rules matching suspicious command-line arguments, network activity, and parent-child process anomalies for each LOLBin
  4. Analyze Parent-Child Relationships — Flag unexpected parent processes spawning LOLBins (e.g., Excel spawning certutil, Word spawning mshta)
  5. Score and Prioritize Alerts — Apply risk scoring based on argument anomaly, parent process, execution path, and network indicators
  6. Generate Detection Report — Produce a structured report of all LOLBin abuse detections with MITRE ATT&CK mapping

Expected Output

  • JSON report listing detected LOLBin abuse events with severity scores
  • MITRE ATT&CK technique mapping for each detection (T1218, T1105, T1140, T1127)
  • Parent-child process anomaly analysis
  • Sigma rule match details with raw event data

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

abusing-dpapi-for-credential-access

무료

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing saved credential exposure in authorized tests
  • Examining collected DPAPI files offline
  • Reviewing protected browser and RDP credentials
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

abusing-shadow-credentials-for-privesc

무료

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing risky permissions identified in BloodHound
  • Validating account takeover without resetting a password
  • Generating directory change records during security exercises
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

achieving-cmmc-level-2-compliance

무료

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Define the assessment scope for systems handling controlled information
  • Calculate an SPRS score and prioritize unmet security requirements
  • Prepare security plans, remediation milestones, and assessment evidence
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

acquiring-disk-image-with-dd-and-dcfldd

무료

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Preserving a suspect drive before investigation
  • Creating evidence copies of USB devices or memory cards
  • Verifying that a disk image matches its source
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

analyzing-active-directory-acl-abuse

무료

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Auditing excessive Active Directory permissions
  • Investigating privilege escalation paths from ordinary accounts
  • Reporting affected objects and permission remediation recommendations
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

analyzing-android-malware-with-apktool

무료

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Triage suspicious APK files without running them
  • Inspect dangerous permission combinations and suspicious API calls
  • Extract network indicators for malware detection rules
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

mukul975의 스킬 모두 보기

이 스킬의 문제 신고