SignalHunt
← All rules

SYS-4002

high

LOLBin Used to Fetch a Remote Payload

Detects a living-off-the-land binary (certutil, bitsadmin) making an outbound network connection - both are legitimate Windows tools frequently abused to download second-stage payloads while evading application allow-listing.

T1105T1218.010

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 3,
    "Image|endswith": [
      "certutil.exe",
      "bitsadmin.exe"
    ],
    "Initiated": true
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 3

Required log fields

  • Image
  • DestinationIp
  • DestinationPort
  • Initiated

Enabling this in your environment

Where: Sysmon configuration - NetworkConnect (Event ID 3) enabled, ideally scoped to a process include-list to avoid excessive volume.

sysmon64.exe -c sysmonconfig.xml

Network event volume from Sysmon can be very high without filtering - most public baseline configs scope Event ID 3 to a shorter list of processes of interest rather than logging every connection.

False positives

  • Legitimate certutil usage for certificate management that happens to touch a CRL/OCSP endpoint over the network

References