Suspicious LOLBin Internet Download and File Creation
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Microsoft Sentinel (KQL)
