LOLBIN Execution From Abnormal Drive
Detects the execution of Living Off The Land Binaries (LOLBINs) from an unusual or abnormal drive, such as a mounted ISO. This behavior can indicate an attempt by an adversary to evade detection by executing legitimate system tools from non-standard locations, often associated with initial access or defense evasion techniques.
Sigma
