Modern cyber adversaries are increasingly avoiding traditional file-based malware, choosing instead to blend seamlessly with normal system operations. This evasive technique, known as Living-off-the-Land Binaries (LOLBins), involves utilizing legitimate, trusted system tools to execute malicious actions while bypassing standard security whitelists. Because these native utilities are already inherently trusted by the operating system, detecting their subversion requires advanced behavioral telemetry rather than relying purely on static indicators.
Google Threat Intelligence provides security teams with powerful capabilities to uncover these hidden behaviors. Native applications like PowerShell, Certutil, and Rundll32 are frequently exploited by threat actors. For instance, attackers often misuse PowerShell for fileless execution through encoded commands, or leverage Certutil to retrieve remote payloads and decode malicious files. Similarly, Rundll32 is commonly subverted to execute web-hosted scripts directly inside trusted processes. By constructing precise advanced search queries within the platform, analysts can quickly pivot toward behavioral anomalies, targeting specific parameters like hidden window flags, unusual parent-child process relationships, or suspicious network connections.
To streamline this defensive process, security operations can easily operationalize their threat hunting through continuous automation. The platform allows analysts to utilize Saved Searches and integrate these behavioral queries directly into their workflows via the API. For organizations looking to scale their capabilities, the incorporation of Agentic AI automates the deep inspection of binaries. Instead of performing tedious manual checks, analysts can prompt the AI to examine specific file hashes and identify subtle signs of LOLBin manipulation, such as the sophisticated masquerading tactics seen in major supply chain compromises like the SUNBURST backdoor. Embracing these advanced search features allows security teams to effectively turn native system tools from security blind spots into proactive hunting assets.
Additional Resources, Links, and Examples:
Hunt: Stealthy Encoded Execution
Hunt: External Script Downloads from ngrok
Hunt: Remote Payload Retrieval
Hunt: Local Obfuscation Decoding into an executable
Hunt: Script Host Proxying
Hunt: Suspicious DLL Entry Points submitted massively to Google TI
GTIDocs: Saved Searches
DTIDocs: API List Saved Searches
