Most Popular Detection 2026 – LOLBin Proxy Execution via Rundll32/Regsvr32/Mshta

Ibrahim Saud@tektrix

•updated 5 days ago•0•0•0

Detects the execution of known Windows 'Living-off-the-Land' binaries (rundll32.exe, regsvr32.exe, mshta.exe) when they originate from web browsers or office productivity applications, or when they are executed with command-line arguments indicative of network resource loading, remote scripting, or code execution bypasses.