Anthropic-Cybersecurity-Skills/skills/hunting-for-lolbins-execution-in-endpoint-logs/assets/template.md

LOLBins Execution Hunt Template

Hunt Metadata

Field	Value
Hunt ID	TH-LOLBIN-YYYY-MM-DD-NNN
Analyst
Date
Status	[ ] In Progress / [ ] Complete

Hypothesis

Adversaries are abusing legitimate Windows system binaries to execute malicious payloads, download tools, or bypass application control in the environment.

LOLBin Findings

#	Timestamp	Host	User	LOLBin	Command Line	Parent Process	Category	Severity
1

Suspicious Parent-Child Relationships

Parent Process	Child LOLBin	Host	User	Assessment

Network Activity from LOLBins

LOLBin	Host	Destination IP	Destination Port	Domain	Assessment

Recommendations

1. Block: [URLs/IPs contacted by LOLBins]
2. Detect: [New detection rules for observed patterns]
3. Harden: [Application control policy updates]
4. Investigate: [Endpoints requiring forensic analysis]