Browser LabLD-SOC2-LAB-008Hard
Browser LabLD-SOC2-LAB-008Hard22 min
Hunt a Living-off-the-Land Execution at Scale
No alert fired, but intelligence says an actor executes payloads via living-off-the-land binaries your rules don't cover. Your hypothesis: an Office app should never spawn a scripting host. You have millions of process-creation events aggregated by parent-child pair. Hunt the gap.
What you will be able to do
- Name the scale technique that surfaces rare outliers without a signature.
- Identify the long-tail suspicious execution and map its technique.
- Close the loop into a detection and value a negative hunt.
Threat HuntingDetection EngineeringT1218.005 — System Binary Proxy Execution: MshtaT1059.001 — Command and Scripting Interpreter: PowerShell
Sign in to start this lab.
Sign in