Lion Cipher Lab
Spot living-off-the-land abuse: when certutil, rundll32, mshta, and regsvr32 aren't doing their day job
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
The tools that catch malware are looking for malware — a file the attacker brought with them. So attackers increasingly bring no file at all. They 'live off the land': they use the legitimate, Microsoft-signed programs already on every Windows machine — certutil, rundll32, mshta, regsvr32, powershell — to download, decode, and run their code. There is no strange executable to flag, the binary is signed by Microsoft, and it is on every allow-list because blocking it would break Windows. This is the modern default for hands-on-keyboard intrusions, and it is exactly why the defender's most…
What you'll learn
- reading a process-creation record (Sysmon Event ID 1 / Windows Security 4688) for the command line, not just the image name
- recognising the LOLBin (living-off-the-land binary) abuse patterns for certutil, rundll32, mshta, regsvr32, and powershell
- telling a legitimate administrative use of a signed built-in tool from an abusive one purely by its arguments
- understanding why attackers proxy execution through trusted, signed Windows binaries (allow-list and AV evasion, blending in)
- mapping each observed abuse to MITRE ATT&CK (T1218 System Binary Proxy Execution + .005/.010/.011, T1105 Ingress Tool Transfer, T1059)
- the Squiblydoo regsvr32 pattern and the certutil download cradle on sight
- judgment: writing detections on the abusive argument pattern and its context, not on blocking the tool itself
Steps in this lab
- What 'living off the land' means, and why it beats bringing malware
- The one rule of this drill: read the command line, not the image name
- Pair 1 — certutil: certificate tool vs. download cradle (T1105)
- Pair 2 — rundll32: run a DLL export vs. run a remote/JS payload (T1218.011)
- Pair 3 — mshta: local HTA app vs. remote HTA URL (T1218.005)
- Pair 4 — regsvr32: register a local DLL vs. Squiblydoo remote scriptlet (T1218.010)
- Pair 5 — powershell: signed automation vs. hidden encoded blob (T1059)
- Step back: read the whole story the ten records tell
- When the command line settles it, when it can be fooled — and how a pro detects LOLBins better