Lion Cipher Lab

Hunt living-off-the-land (LOLBin) execution from process telemetry (build the analytic from scratch)

• SOC Analyst / Blue Team
• Advanced
• ~80 min
• Free · no account required

Why it matters

An attacker who lands on a Windows box has a choice: drop their own malware (loud -- antivirus and EDR are watching for unknown binaries, and application allow-listing may refuse to run anything not pre-approved), or 'live off the land' by abusing the trusted, signed, Microsoft-shipped programs that are ALREADY on every host -- certutil to download a payload, PowerShell to run an encoded command, regsvr32 to execute a remote scriptlet, rundll32 and mshta to proxy their code behind a signed executable. This is not a fringe trick; it is the default tradecraft of modern intrusions, precisely…

What you'll learn

• what a LOLBin ('living off the land binary') is and why you cannot block it: it is a signed, Microsoft-trusted program present on every host, so you detect anomalous USE, not the binary
• reading Sysmon-style process-creation telemetry (timestamp, host, user, ProcessId, ParentImage, Image, CommandLine) and knowing what each field buys you
• generating a self-contained benign baseline plus four planted needles as pure JSON test-data on your own machine (nothing attacked, executed, or deployed)
• writing a Python analytic that scores each event with simple, explainable heuristics: a trusted binary reaching a URL (download cradle), an -EncodedCommand base64 blob, an office/browser app parenting an interpreter, and a regsvr32/rundll32/mshta scriptlet proxy-exec
• decoding a PowerShell -EncodedCommand blob (base64 + UTF-16LE) to reveal the real command hiding inside it
• triaging findings into a ranked report and mapping every needle to its MITRE ATT&CK technique ID (T1218, T1059.001, T1105, T1027, T1218.010)
• naming the false positives honestly: certutil -store and rundll32 Control_RunDLL are legitimate, so the analytic keeps them at zero and never reports them
• the single-event blind spot -- why the Word->PowerShell needle is nearly invisible to a command-line-only scan and only the PARENT process gives it away -- and why full command-line logging must be ON first
• the judgment of WHEN LOLBin hunting matters, WHY it is noisy, and HOW Sysmon configs, Sigma rules, and EDR behavioral analytics productionize this exact analytic

Steps in this lab

1. What a LOLBin is, and why you hunt anomalous use instead of the binary
2. Generate self-contained telemetry: a benign baseline plus four needles
3. Build the hunter: an allow-list of trust, four anomaly signatures, one score
4. Run it and watch the needles rank above an honestly-quiet baseline
5. The blind spot: why command-line logging AND the parent must both be on
6. Map every needle to ATT&CK, and why the trusted-binary angle matters
7. The judgment: when LOLBin hunting matters, and how the pros do it

Open the full interactive lab →