DEF CON 34 – Angelo Frasca Caccia – Signed Microsoft binary chain used for kernel privilege primitives (LOLBin chaining)

Ankit Mehta@Secvyn

•updated Aug 13, 2026•5•0•5

This rule detects sequences of suspicious process activity where multiple known LOLBins (Living Off the Land Binaries) execute in a chain. Specifically, it monitors for scenarios where a process from a predefined list (e.g., msdt.exe, mmc.exe, rundll32.exe) initiates another process from the same list, often indicative of proxy execution or privilege escalation techniques involving suspicious command-line parameters like '-embedding', 'NtLoadDriver', or '/i:'.