Writing Effective Sigma Rules for LOLBin Detection in Production SIEMs

Sigma is the de-facto standard for portable SIEM detection rules. Writing effective Sigma rules for living-off-the-land binary (LOLBin) abuse is genuinely difficult: the same binaries are used by attackers and legitimate administrators, and overly broad rules produce alert fatigue that leads defenders to disable detection entirely. This report covers the LOLBin patterns observed most frequently in 2026 post-exploitation activity and documents Sigma rules with specific false positive mitigation strategies for each, drawn from production deployment experience across multiple SIEM platforms.

//msiexec Abuse

msiexec is the Windows Installer executable. Legitimate use is installing MSI packages. Attackers abuse the /y (register COM server) and /z (unregister) flags to load arbitrary DLLs, and the /i flag with a remote URL to fetch and execute MSI packages without writing them to disk first.

msiexec Remote MSI Fetch

title: msiexec Remote URL Install
id: e5f3a7c1-9b2d-4e6f-8a0c-2b4d6e8f0a2c
status: production
description: Detects msiexec fetching an MSI from a remote URL, a technique used
             by multiple malware families including DarkGate and StealC loaders.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: 'msiexec.exe'
    CommandLine|contains|all:
      - '/i'
      - 'http'
  condition: selection
falsepositives:
  - Enterprise software deployment tools (SCCM, Intune) running msiexec with URLs
  - Reduction: add filter for parent processes (SCCM agent: ccmexec.exe, Intune: intuneManagementExtension.exe)
filter_legitimate:
  ParentImage|endswith:
    - 'ccmexec.exe'
    - 'intuneManagementExtension.exe'
    - 'msiexec.exe'  # chained installers
condition: selection and not filter_legitimate
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.007

msiexec DLL Registration (/y flag)

title: Suspicious msiexec DLL Registration
id: a2c4e6b8-0d2f-4a6c-8e0b-2d4f6a8c0e2b
status: production
description: msiexec /y loads a DLL as a COM server. Legitimate use is rare outside
             of software installers. Abuse loads malicious DLLs from user-writable paths.
logsource:
  product: windows
  category: image_load
detection:
  selection_proc:
    Image|endswith: 'msiexec.exe'
  selection_path:
    ImageLoaded|contains:
      - 'AppData'
      - 'ProgramData'
      - 'UsersPublic'
      - 'Temp'
  filter_system:
    ImageLoaded|startswith:
      - 'C:Windows'
      - 'C:Program Files'
      - 'C:Program Files (x86)'
  condition: selection_proc and selection_path and not filter_system
falsepositives:
  - First-run application setups that stage DLLs in %ProgramData%
  - Rate: ~2/week in tested environment after filter applied
level: high

//mavinject Abuse

mavinject.exe is a Microsoft-signed Windows utility for injecting DLLs into running processes, originally designed for App-V virtualisation support. It is trivially abused for process injection by any user-level process.

title: Suspicious mavinject Process Injection
id: b4d6f8a0-c2e4-6b8d-0f2a-4c6e8b0d2f4a
status: production
description: mavinject.exe is a signed Microsoft binary for process injection. Any use
             outside of App-V management is suspicious and worth immediate investigation.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: 'mavinject.exe'
    CommandLine|contains: '/INJECTRUNNING'
  filter_appv:
    ParentImage|endswith:
      - 'AppVClient.exe'
      - 'AppVClientService.exe'
  condition: selection and not filter_appv
falsepositives:
  - Microsoft App-V client (rare in modern enterprise environments)
  - Rate: 0 false positives in 30-day deployment after filter applied
level: critical
tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055.001

//regsvr32 Abuse

regsvr32 registers and unregisters OLE controls. The Squiblydoo technique abuses its ability to load a COM scriptlet (.sct file) from a remote URL, bypassing AppLocker and WDAC policies that restrict script execution. Despite being documented since 2016, this technique remains prevalent in 2026 loaders.

title: regsvr32 Remote Scriptlet Execution (Squiblydoo)
id: c6e8b0d2-f4a6-8c0e-2b4d-6f8a0c2e4b6d
status: production
description: regsvr32 loading a scriptlet from a remote URL. Classic Squiblydoo
             technique. Still used in DarkGate, StealC, and generic commodity loaders.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '
egsvr32.exe'
    CommandLine|contains:
      - '/i:http'
      - '/i:ftp'
      - 'scrobj.dll'
  filter_legitimate:
    CommandLine|contains:
      - 'C:Windows'
      - 'C:Program Files'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate COM component registration from vendor scripts (rare with /i:http)
  - Rate: ~1/month in tested environment
level: high
tags:
  - attack.defense_evasion
  - attack.t1218.010

//certutil Abuse

certutil is a certificate management utility. Attackers use it to decode base64-encoded payloads (-decode flag), download files (-urlcache -split -f), and occasionally to encode payloads. The -decode abuse pattern is particularly common in phishing-delivered loaders since it requires no additional tools.

title: certutil Payload Decode or Download
id: d8f0a2c4-e6b8-0d2f-4a6c-8e0b2d4f6a8c
status: production
description: certutil used to decode a base64 file (common payload delivery) or
             to download a file via -urlcache. Both patterns are used in commodity loaders.
logsource:
  product: windows
  category: process_creation
detection:
  selection_decode:
    Image|endswith: 'certutil.exe'
    CommandLine|contains: '-decode'
  selection_download:
    Image|endswith: 'certutil.exe'
    CommandLine|contains|all:
      - '-urlcache'
      - '-f'
  condition: 1 of selection_*
falsepositives:
  - PKI administrators using certutil for legitimate certificate operations
  - Reduction: filter on CommandLine containing '.cer', '.crt', '.p7b' extensions
filter_legit_ext:
  CommandLine|endswith:
    - '.cer'
    - '.crt'
    - '.p7b'
    - '.pfx'
condition: (1 of selection_*) and not filter_legit_ext
level: medium
tags:
  - attack.defense_evasion
  - attack.t1140

//Deployment and Tuning Guidance

Deploying LOLBin Sigma rules without tuning is a reliable way to produce alert fatigue. The general approach: deploy all rules at informational for one week, review all triggering events, add parent process filters for confirmed-legitimate triggers, then promote to production severity.

Parent Process Correlation

The most effective false positive mitigation is parent process filtering. Legitimate msiexec invocations from SCCM come from ccmexec.exe. Legitimate regsvr32 from software installers typically have parent processes in Program Files. Any LOLBin invoked with a parent of cmd.exe, powershell.exe, wscript.exe, or cscript.exe that is itself a child of a browser or Office application is almost never legitimate.

# High-fidelity chain: LOLBin spawned by script engine spawned by Office/browser
# This pattern has near-zero legitimate use and very high malware signal
title: LOLBin Chain via Office or Browser Parent
detection:
  selection_lolbin:
    Image|endswith:
      - 'msiexec.exe'
      - '
egsvr32.exe'
      - 'certutil.exe'
      - 'mavinject.exe'
  selection_script_parent:
    ParentImage|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'wscript.exe'
      - 'cscript.exe'
  selection_office_grandparent:
    # Requires ParentParentImage support (Sysmon 14+, Elastic with process.parent.parent)
    ParentParentImage|endswith:
      - 'WINWORD.EXE'
      - 'EXCEL.EXE'
      - 'OUTLOOK.EXE'
      - 'chrome.exe'
      - 'irefox.exe'
      - 'msedge.exe'
  condition: all of selection_*
level: critical