LOLBin-Triage

Living Off the Land Binary (LOLBin) Triage Case Studies for Cybersecurity Analysis

This repository documents real-world forensic triage cases involving the abuse of legitimate Windows binaries—also known as LOLBins—for malicious purposes. Each case study follows a structured, professional-grade methodology aligned with incident response workflows and exam objectives from the CompTIA CySA+ certification.

---

Repository Goals

• Provide technically rigorous, attacker-centric IOC case studies
• Train cybersecurity analysts to recognize LOLBin abuse patterns
• Demonstrate structured triage workflows using real telemetry sources
• Build a reusable reference system for host-based and network-based investigations

---

Case Study Format

Each case follows a consistent structure:

1. Technical Definition
2. Source of IOC (Telemetry Origin)
3. Triage Framework Declaration
4. Standard Investigative Toolkit (Ordered and Layered)
5. Host OS Layer Mapping
6. Cross-Layer Interaction Pivots
7. OSI Layer Relevance
8. Attacker Behavior Interpretation
9. Defender Action Summary
10. Attacker Strategy Notes

---

Current Case Studies

• IOC #11 – mshta.exe Execution (Unexpected HTA Launch)
  Abuse of a trusted Windows binary to launch remote or inline scripts for initial access and persistence.

More case studies will be added regularly.

---

Author

Steven Tuschman
GitHub: CompCode1
Engineered Cybersecurity Architecture | Triage Systems | IOC Pattern Recognition

---

License

This project is licensed under the MIT License.