Rare Windows LOLBin Execution
This rule identifies rarely executed Windows binaries that are listed in the LOLBAS (Living Off the Land Binaries and Scripts) project dataset. By comparing process execution events from the last 30 days against the official LOLBAS list, it surfaces the least frequently used binaries, which may indicate unusual activity or potentially malicious use of legitimate system tools.
Microsoft Sentinel (KQL)
