LOLBins: What are they & How to Detect Them

What it is

A Huntress analysis of detecting malicious LOLBin use, focused on net.exe abuse to create local accounts. The summary already names the core heuristics and two IOCs; the page carries several additional verbatim command lines and credential IOCs worth hunting for.

What to do

Beyond the baselining and process-lineage checks already summarized, the page supplies concrete strings to detect on. Huntress observed these exact command lines used across multiple customers:

net /add user WDAGUtilltyAccount Ujmqaz5055 /y
net /add user ASP.NET Ujmqaz5055

Two detection signals to encode:

• Argument order. Legitimate use follows net user <username> <password> /add with /add last. The malicious samples place /add immediately after net — an ordering anomaly you can alert on directly.
• Absent-baseline rule. If your admins do not use net.exe at all, treat any net.exe with user, localgroup, or add arguments as malicious outright.

Recurring credential IOCs to hunt (in addition to Ujmqaz5055 and WDAGUtilltyAccount from the summary):

• Passwords: P@ssw0rd01!, Nullpass123, JapanNight!128, Noface66Nocase!
• Username: ASP.NET

Note the deliberate misspelling in WDAGUtilltyAccount (second l should be i) — it mimics the legitimate WDAGUtilityAccount, so match the exact malicious spelling.

Confirm-malicious process lineage for a spawned command line — parent or grandparent being any of:

• wmiprvse.exe (type 3 remote network connection)
• PSExec.exe
• sqlservr.exe (MS SQL Server)

versus the benign cmd.exe ← Explorer.exe chain of an interactive admin.

Caveats

The /add-last structure is described as a convention many admins follow, not a rule — legitimate commands can also place it elsewhere, so ordering alone is a signal, not proof. The credential list is what Huntress observed over time, not exhaustive; the page itself notes the Ujmqaz5055 password has been reported by others too. The username list is cut off in the fetched text, so treat the usernames above as partial.