Detecting Malicious Use of LOLBins | Huntress

This briefing explains how adversaries misuse legitimate system binaries (LOLBins) like net.exe, cmd.exe, and PowerShell to conduct stealthy operations—user creation, privilege escalation, lateral movement, persistence, and data exfiltration—and provides detection heuristics and mitigation advice, including process lineage checks, account-naming convention validation, command-line structure analysis, and examples of observed malicious commands and reused credentials.