Skip to content
Threat Feed
Subscribe
medium advisory

Living-off-the-land Binary Execution from Non-System Drives

This detection focuses on the execution of common Windows system binaries (LOLBins) originating from non-standard drive locations, a technique frequently used in ransomware and loader deployments to bypass directory-based execution restrictions.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Action
Monitor or close
Sources
1 public source
Freshness
Revision 1Nov 10, 03:04 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Attackers often leverage mounted ISO files, removable media, or temporary drive mappings to execute malicious code using legitimate system tools. This behavior is documented in multiple incident reports involving malware loaders and ransomware groups that rely on bypassing standard C: drive execution monitoring.

Impact

Execution of signed system binaries from non-standard drives can facilitate lateral movement, payload execution, and persistence while evading traditional path-based allowlists.

Recommendation

  • Deploy the provided Sigma rule to monitor for process creation events originating from drives other than C:.
  • Baseline common administrative tasks in the environment to reduce false positives on multi-drive servers.
  • Review process creation logs for LOLBins (e.g., rundll32, regsvr32, mshta) where the CurrentDirectory field does not begin with 'C:'.

Threat Hunt

Identify processes spawned from non-standard drive letters

medium medium confidence convert to detection

Data: CurrentDirectory, Image

Detection coverage 1

Detect LOLBIN Execution From Abnormal Drive

medium

Detects common LOLBins executing from drives other than C:, often indicative of execution from mounted ISOs or removable media

sigma tactics: stealth sources: process_creation, windows

Detection queries are available on the platform. Get full rules →