I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.

Problem it tries to solve

Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.

What the tool does

• Collects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)
• Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)
• Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)
• Binary masquerading detection via PE OriginalFileName
• PPID spoofing anomaly checks
• Command-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)
• False-positive suppression + de-duplication
• Timeline reconstruction (±5–10 min window) + process lineage
• Local web dashboard for triage
• Automated Markdown incident reports + webhook support (Slack/Discord/SIEM)

Architecture highlights

• Modular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcher
• Rules can be written in YAML (declarative) or pure Python
• Built-in threat emulation test harness (11 scenarios currently)

Current limitations

• psutil mode has polling latency (can miss very short-lived processes)
• Still user-mode only (no kernel/ETW consumer yet)
• Needs more real-world tuning of suppression rules

GitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System

Would love feedback on:

• Rule coverage / false positive rates you’ve seen with similar approaches
• Missing high-value sequential chains
• Whether the dashboard and timeline reconstruction are useful in practice
• Any other LOLBins or techniques I should prioritize

Happy to answer technical questions or discuss design decisions.