hunting-living-off-the-land-binaries

检测 Windows 事件日志和 Sysmon 遥测数据中对离地攻击（Living Off The Land Binaries，LOLBAS）的滥用，包括 certutil、wmic、mshta、regsvr32 和 rundll32 等工具。通过将进程创建事件与 LOLBAS 项目数据库交叉比对来构建检测规则。适用于针对无文件攻击技术的威胁狩猎或构建 SIEM 检测规则的场景。

9 stars

bykillvxk

View on GitHub Installation ↓

Best use case

hunting-living-off-the-land-binaries is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using hunting-living-off-the-land-binaries should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/hunting-living-off-the-land-binaries/SKILL.md --create-dirs "https://raw.githubusercontent.com/killvxk/cybersecurity-skills-zh/main/skills/hunting-living-off-the-land-binaries/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/hunting-living-off-the-land-binaries/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How hunting-living-off-the-land-binaries Compares

Feature / Agent	hunting-living-off-the-land-binaries	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# 狩猎离地攻击二进制文件（LOLBAS）

## 说明

通过分析 Windows 进程创建事件（事件 ID 4688 / Sysmon 1）并将命令行与 LOLBAS 项目已知恶意模式进行匹配，检测 LOLBAS 滥用行为。

```python
import json
import requests

# 获取 LOLBAS 数据库
resp = requests.get("https://lolbas-project.github.io/api/lolbas.json")
lolbas_db = resp.json()

# 提取二进制文件名和可疑命令
for entry in lolbas_db:
    print(entry["Name"], [cmd["Command"] for cmd in entry.get("Commands", [])])
```

关键检测模式：
1. certutil -urlcache -split -f（下载）
2. mshta vbscript:Execute（脚本执行）
3. regsvr32 /s /n /u /i:http（squiblydoo 技术）
4. rundll32 javascript:（脚本执行）
5. wmic process call create（进程创建）
6. bitsadmin /transfer（下载）

## 示例

```python
# 将 Sysmon 事件 ID 1 与 LOLBAS 模式匹配
import Evtx.Evtx as evtx
with evtx.Evtx("Microsoft-Windows-Sysmon.evtx") as log:
    for record in log.records():
        xml = record.xml()
        if "certutil" in xml.lower() and "urlcache" in xml.lower():
            print(f"检测到 LOLBAS: {xml}")
```

Related Skills

performing-threat-landscape-assessment-for-sector

from killvxk/cybersecurity-skills-zh

通过分析威胁行为者定向攻击模式、常见攻击向量和行业特定漏洞，开展行业特定威胁态势评估，为组织风险管理提供决策依据

performing-threat-hunting-with-yara-rules

from killvxk/cybersecurity-skills-zh

使用 YARA 模式匹配规则在文件系统和内存转储中狩猎恶意软件、可疑文件和入侵指标。涵盖规则编写、yara-python 扫描以及与威胁情报源的集成。

performing-threat-hunting-with-elastic-siem

from killvxk/cybersecurity-skills-zh

使用 KQL/EQL 查询、检测规则和 Timeline 调查在 Elastic Security SIEM 中执行主动威胁狩猎，识别绕过自动检测的威胁。适用于 SOC 团队针对特定 ATT&CK 技术进行狩猎、调查异常行为，或使用 Elasticsearch 和 Kibana Security 验证检测覆盖缺口。

hunting-for-webshells-in-web-servers

from killvxk/cybersecurity-skills-zh

通过扫描高熵值文件、可疑的 PHP/JSP/ASP 模式（eval、base64_decode、system、passthru）、 Web 根目录中近期修改的文件以及异常文件大小，检测植入 Web 服务器的 Webshell（网页后门）。使用香农熵（Shannon entropy）计算标记混淆载荷，并通过正则表达式模式匹配已知 Webshell 特征。