Detection of LOLBin Relocation Techniques

Threat actors often leverage native Windows binaries (LOLBins) to execute malicious code while blending into legitimate system activity. Defenders commonly use path-based allowlisting or monitoring to detect unauthorized execution of tools like certutil.exe or rundll32.exe. To bypass these defenses, attackers execute copy operations - using native utilities like cmd.exe, powershell.exe, or robocopy.exe - to move these binaries from protected system directories such as System32, SysWOW64, or WinSxS to non-standard, user-writable locations. By executing the relocated binary, the attacker avoids alerts triggered by execution from privileged system paths. This behavior is a common precursor to malware delivery and execution, as observed in various documented attacks, including HTML smuggling and ransomware campaigns. Monitoring for the relocation of specific dual-use binaries is critical for identifying lateral movement and persistence attempts.

Impact

Successful relocation of LOLBins allows attackers to maintain stealth during the execution of malicious payloads, potentially bypassing endpoint security policies. This technique facilitates further compromise, including credential theft, lateral movement, or the deployment of ransomware within a target environment.

Recommendation

• Deploy the provided Sigma rule to detect the movement of dual-use binaries from protected system directories.
• Tune the detection to account for administrative scripts or deployment tools that may legitimately move binaries, though such activity should generally be audited.
• Audit file creation events in sensitive directories to correlate copy operations with subsequent execution patterns.