LOLBin Attacks Explained

~Anyrun~
Threat actors abuse legitimate Windows binaries (e.g., rundll32, certutil) to execute malicious code and evade detection.
-
IOCs: (None identified)
-
#DefenseEvasion #LOLBin #ThreatIntel

Recent #Xworm infections (esp. during tax season) follow a pattern:
mshta.exe → Scheduled Tasks → IEX execution.

#ThreatHunting #DetectionEngineering #MalwareAnalysis #DefenseEvasion

Abusing Windows COM objects for stealthy execution?

Use 'MMC20.Application' to execute commands outside direct process lineage tracking.

Works well against naive EDR correlation.

#RedTeam #DefenseEvasion #infosec #Cybersecurity #EDR