Rule Info
Name
Inverted LOLBin Executable Strings in CommandLine
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects reversed/inverted living-off-the-land binary (LOLBin) executable names in
command line arguments. Adversaries may reverse binary name strings to bypass
signature-based detection that matches plain-text LOLBin names.
Reference
Internal Research
Date
2026-07-17 00:00:00
Modified
None
Id
d5c3f2a1-8b4e-4c7d-9f1a-2e6b0d8c5f3a
Tags
attack.execution attack.t1059.003 attack.stealth attack.t1027.010
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR