# LOLBins Execution Hunt Template

## Hunt Metadata
| Field | Value |
|-------|-------|
| Hunt ID | TH-LOLBIN-YYYY-MM-DD-NNN |
| Analyst | |
| Date | |
| Status | [ ] In Progress / [ ] Complete |

## Hypothesis
> Adversaries are abusing legitimate Windows system binaries to execute malicious payloads, download tools, or bypass application control in the environment.

## LOLBin Findings

| # | Timestamp | Host | User | LOLBin | Command Line | Parent Process | Category | Severity |
|---|-----------|------|------|--------|-------------|----------------|----------|----------|
| 1 | | | | | | | | |

## Suspicious Parent-Child Relationships

| Parent Process | Child LOLBin | Host | User | Assessment |
|---------------|-------------|------|------|------------|
| | | | | |

## Network Activity from LOLBins

| LOLBin | Host | Destination IP | Destination Port | Domain | Assessment |
|--------|------|---------------|-----------------|--------|------------|
| | | | | | |

## Recommendations
1. **Block**: [URLs/IPs contacted by LOLBins]
2. **Detect**: [New detection rules for observed patterns]
3. **Harden**: [Application control policy updates]
4. **Investigate**: [Endpoints requiring forensic analysis]
