hunting-living-off-the-land-binaries — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hunting-living-off-the-land-binaries (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Detect LOLBAS abuse by analyzing Windows process creation events (Event ID 4688 / Sysmon 1) and matching command lines against known malicious patterns from the LOLBAS project.
import json
import requests
# Fetch LOLBAS database
resp = requests.get("https://lolbas-project.github.io/api/lolbas.json")
lolbas_db = resp.json()
# Extract binary names and suspicious commands
for entry in lolbas_db:
print(entry["Name"], [cmd["Command"] for cmd in entry.get("Commands", [])])Key detection patterns:
# Match Sysmon Event ID 1 against LOLBAS patterns
import Evtx.Evtx as evtx
with evtx.Evtx("Microsoft-Windows-Sysmon.evtx") as log:
for record in log.records():
xml = record.xml()
if "certutil" in xml.lower() and "urlcache" in xml.lower():
print(f"LOLBAS detected: {xml}")~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.