Bijo Mijo
@0din0 followers5 downloads3 copies0 likes84 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
This rule detects instances where common web browsers (e.g., Chrome, Edge, Firefox) launch specific Living Off The Land Binaries (LOLBins) or scripting interpreters. The LOLBins and interpreters include `cmd.exe`, `powershell.exe`, `rundll32.exe`, `regsvr32.exe`, `msiexec.exe`, `mshta.exe`, `hh.exe`, `certutil.exe`, and `bitsadmin.exe`. This activity can indicate malicious intent, such as drive-by downloads, exploit kit activity, or initial access attempts where an attacker leverages a browser to execute system utilities for further compromise.
