Hunting for LoLBins
Summary: Cisco Talos analyzed telemetry from Cisco AMP for Endpoints to measure abuse of Windows living-off-the-land binaries, finding that at least 99.8 percent of all LoLBin invocations are not worth further investigation and that at least 99.986 percent of PowerShell invocations are legitimate. The post walks through campaigns using PowerShell, msbuild.exe, csc.exe and rundll32.exe, including Sodinokibi and Gandcrab reflective DLL loaders, Invoke-Obfuscation layers, and a Cobalt Strike stager hidden inside a malicious jQuery library that spoofed the code.jquery.com host header while requesting IP address 134.209.176.24.
What you should know: The same binaries your administrators depend on carry the attacks, and the noise ratio is the problem: with roughly 0.014 percent of PowerShell executions warranting in-depth investigation, hunting teams face a detection problem measured in billions of daily data points rather than a blocking problem.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026