Detecting Living Off the Land Attacks
Monitor for suspicious use of legitimate Windows binaries (LOLBins) including certutil, mshta, rundll32, regsvr32, and others used in fileless and living-off-the-land attack techniques.
Detecting Living Off The Land Attacks
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
autohandai
Updated Detecting Living Off The Land Attacks by autohandai · 3e44302
npx skillmds@latest add autohandai-community-skills/detecting-living-off-the-land-attacks File contents
---name: detecting-living-off-the-land-attacksdescription: Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.license: Apache-2.0---# Detecting Living Off the Land AttacksMonitor for suspicious use of legitimate Windows binaries (LOLBins)including certutil, mshta, rundll32, regsvr32, and others used infileless and living-off-the-land attack techniques.
autohandai/community-skills/tree/main/detecting-living-off-the-land-attacks commit 3e44302252
Frequently asked questions
Run npx skillmds@latest add autohandai-community-skills/detecting-living-off-the-land-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns. It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.
autohandai (@autohandai-community-skills) published this skill. Their other Agent Skills are listed on their SkillMD profile.