Behavioral LOLBins detection engine with sequential correlation, PE masquerading checks, and Sysmon integration

I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback. Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context. What the tool does Collects process telemetry (prefers Sysmon Event ID 1, falls back to psutil) Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.) Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades) Binary masquerading detection via PE OriginalFileName PPID spoofing anomaly checks Command-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing) False-positive suppression + de-duplication Timeline reconstruction (±5–10 min window) + process lineage Local web dashboard for triage Automated Markdown incident reports + webhook support (Slack/Discord/SIEM) Architecture highlights Modular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcher Rules can be written in YAML (declarative) or pure Python Built-in threat emulation test harness (11 scenarios currently) Current limitations psutil mode has polling latency (can miss very short-lived processes) Still user-mode only (no kernel/ETW consumer yet) Needs more real-world tuning of suppression rules GitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System Would love feedback on: Rule coverage / false positive rates you’ve seen with similar approaches Missing high-value sequential chains Whether the dashboard and timeline reconstruction are useful in practice Any other LOLBins or techniques I should prioritize Happy to answer technical questions or discuss design decisions. submitted by /u/nimesh404 [link] [comments]Technical Information Security Content & DiscussionRead More