Proactively hunts for adversary abuse of legitimate, signed system binaries (LOLBins) used to execute malicious payloads, download files, or proxy execution while evading application allowlisting and defense-evasion controls. Use when building LOLBins detection rules for EDR/SIEM or when threat hunting for defense-evasion activity involving trusted system binaries.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-living-off-the-land-binariesnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-living-off-the-land-binaries -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-living-off-the-land-binaries -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-living-off-the-land-binariesgh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-living-off-the-land-binariesgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-living-off-the-land-binaries ~/.claude/skills/hunting-for-living-off-the-land-binaries # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-living-off-the-land-binaries ~/.agents/skills/hunting-for-living-off-the-land-binaries # Codex, Cursor, Gemini CLI, Copilot, OpenCode