Threat Hunt: Suspicious Attachment Initiated LOLBin Execution - Post-Delivery Phishing

Awais Munir@iawais

•updated Dec 24, 2025•136•1•635

Detects execution of Windows LOLBins spawned shortly after a suspicious attachment is written to user accessible paths, a behavior commonly observed in spearphishing campaigns delivering malware loaders and ransomware.