Windows LOLBAS Executed Outside Expected Path

This analytic identifies the execution of Living Off The Land Binaries and Scripts (LOLBAS) from unexpected file paths. LOLBAS are legitimate Windows binaries that can be abused by threat actors for malicious purposes, such as defense evasion or code execution. The rule specifically looks for processes that are identified as LOLBAS tools but are executed from a directory other than their standard or expected system locations (e.g., outside of Program Files, System32, or SysWOW64). This behavior can indicate an adversary attempting to bypass security controls or execute malicious code in a stealthy manner.