ConceptsLOLBin Hunting Methodology

LOLBin Hunting Methodology

A structured approach to hunting for living-off-the-land binary abuse, systematically examining how trusted binaries are used across the environment to find malicious misuse hiding among legitimate activity.

Glossary definition

6 direct links6 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Frequency Analysis

The foundation LOLBin Hunting Methodology builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Frequency AnalysisStart here

A hunting and analysis technique that counts how often values occur in a dataset, so rare occurrences stand out, on the principle that unusual, infrequent activity is more likely to be malicious than common, high-volume activity.

lessons

Relatedsorted by lesson coverage

Hunt Hypothesis

lessons

Baseline Analysis

lessons

LOLBin Detection

lessons

LOLBins

lesson

Network Alerts

lesson

Related Lessons

6 lessons cover this concept

Preparing a Defensible Hunt

SOC Analyst

Living-Off-The-Land Behavior Chains

SOC Analyst

Cloud Control-Plane and Workload Hunts

SOC Analyst

Identity, Session, and Token Hunts

SOC Analyst

Persistence, Memory, and Telemetry Evasion

SOC Analyst

Hunt Program Decisions and Measurement

SOC Analyst