Outbound LOLBin Web Request to External Network

Marvens Decayette@IronBranded

•updated Dec 3, 2025•27•1•213

This rule identifies outbound HTTP/HTTPS connections initiated by a known set of living-off-the-land binaries (LOLBins). This has been widely used by malware and threat actors to download payloads, establish C2 channels, or execute remote scripts without dropping additional binaries.