How to Detect Malicious Use of Windows LOLBins
Summary
Huntress describes how defenders can baseline legitimate Windows utility use and spot suspicious LOLBin activity, drawing on cases involving finger.exe, curl.exe, and certutil.exe.
Key points
- Establish a baseline of which native utilities are used, how they run, and how often; review it regularly as legitimate activity changes.
- Look for unexpected parent processes, execution from non-standard directories, unusual command-line flags, first-seen destination IPs or domains, and spikes in execution frequency.
- Huntress analysts observed finger.exe used by threat actors for file downloads and data exfiltration.
- A curl.exe search across Huntress telemetry produced 2,182,554 hits; an unusual PowerShell parent process and command line stood out against routine activity.
- In a certutil.exe case, an encoded PowerShell command launched from sqlservr.exe attempted to download and run a file; Huntress says the activity did not execute successfully on monitored endpoints.
- The article advises targeted restrictions based on confirmed lack of legitimate use rather than broadly blocking utilities that may support administrative workflows.
Article Details
- Defense Focus
- Detect malicious use of legitimate Windows utilities by baselining normal execution and identifying anomalous process, command-line, and network behavior.
- Detection Methods
- Baseline LOLBin usage and compare real-time execution against expected patterns.
- Investigate unexpected parent processes, execution from non-standard directories, unusual command-line flags, first-seen destination IPs or domains, and spikes in execution frequency.
- Search process telemetry for unusual finger.exe and curl.exe activity; refine broad searches using known-malicious patterns.
- Identify anomalous curl.exe invocations spawned by PowerShell.
- Compare PowerShell command lines in Event ID 600 records to established patterns; an encoded PowerShell command leading to certutil.exe was unique in the described incident.
- Data Sources
- Process execution and parent-process telemetry
- Command-line records
- Network connection destinations
- Windows PowerShell Event Log, Event ID 600
- Huntress EDR telemetry
- Elastic search results
- Rule Types
- Behavioral anomaly detection based on environment-specific baselines
- Process and command-line detection
- First-seen destination detection
- Execution-frequency anomaly detection
- Platforms
- Windows
- Defensive Actions
- Establish and regularly revisit environment-specific baselines; quarterly is suggested as a reasonable starting cadence.
- Investigate anomalous parent processes, paths, command-line arguments, destination IPs or domains, and execution frequency.
- Use targeted restrictions only where legitimate use of a specific binary has been ruled out; avoid indiscriminate blocking that could disrupt operational tooling.
- Use EDR for process-execution behavior and consider SIEM correlation across broader log sources when log volume warrants it.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article reports that threat actors have used finger.exe for data exfiltration.T1059.001 · PowerShellAn incident involved an encoded PowerShell command that launched certutil.exe; another example describes PowerShell spawning curl.exe.T1105 · Ingress Tool TransferThe article says threat actors have used finger.exe and curl.exe to download files, and describes certutil.exe downloading a file from an HTTP or HTTPS resource.T1140 · Deobfuscate/Decode Files or InformationThe described encoded PowerShell command used [SYSTEM.WEB.HTTPUTILITY]::URLDECODE before launching certutil.exe.T1218.011 · Rundll32The article describes certutil.exe being used to download a file and finger.exe and curl.exe being used for file download or exfiltration as trusted native utilities.
Vendors
Products
FortiClient EMSprocess of sqlservr.exe, the Microsoft SQL Server application installed as part of the FortiClient Endpoint Management Server (EMS) product. Based on Huntress EDR telemetry and Windows Event Logs, the activity did notHuntress Managed EDRHow Huntress Managed EDR detects LOLBin abuseHuntress Managed SIEMFor organizations with enough log volume to need deeper cross-source correlation, Huntress Managed SIEM complements Managed EDR by correlating LOLBin activity against a broader set of log sources at scale.Microsoft SQL Serverline using [SYSTEM.WEB.HTTPUTILITY]::URLDECODE, itself a child process of sqlservr.exe, the Microsoft SQL Server application installed as part of the FortiClient Endpoint Management Server (EMS) product. Based