by mukul975
detecting-living-off-the-land-with-lolbas helps detect LOLBAS abuse with Sysmon and Windows Event Logs, using process telemetry, parent-child context, Sigma rules, and a practical guide for triage, hunting, and rule drafting. It supports detecting-living-off-the-land-with-lolbas for Threat Modeling and analyst workflows with certutil, regsvr32, mshta, and rundll32.
by mukul975
detecting-living-off-the-land-attacks skill for Security Audit, threat hunting, and incident response. Detect abuse of legitimate Windows binaries like certutil, mshta, rundll32, and regsvr32 using process creation, command-line, and parent-child telemetry. The guide focuses on actionable LOLBin detection patterns, not broad Windows hardening.
by mukul975
The detecting-fileless-malware-techniques skill supports Malware Analysis workflows for investigating fileless malware that runs in memory through PowerShell, WMI, .NET reflection, registry-resident payloads, and LOLBins. Use it to move from suspicious alerts to evidence-backed triage, detection ideas, and next-step hunting.
