Threat Hunting

LOLBin Cluster Hunt

Individual LOLBin usage is noisy. Clusters of 3+ LOLBins from the same process in 15 minutes are near-uniquely malicious. Generate the cluster detection query for your SIEM.

Coming next

This tool is being built. Return soon — or visit the Threat Hunting hub for all available tools.