LOLBin Abuse with Download/Encode/Decode/HTTP/FTP/JavaScript Keywords
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Microsoft Sentinel (KQL)
