---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this SOP is to guide Security Operations Center (SOC) analysts in the investigation and response to suspicious command line executions. The focus is on recognizing and evaluating Living Off the Land Binary (LOLBin) abuse, where attackers leverage legitimate native utilities for malicious purposes, requiring specialized investigation techniques.

## Scope
This SOP applies to all SOC analysts and Incident Response (IR) personnel responsible for detecting, investigating, and responding to suspicious command-line activity across organizational endpoints and servers. It covers alerts generated from Endpoint Detection and Response (EDR) systems and advanced logging capabilities

## Prerequisites
- Access to EDR console and endpoint telemetry logs
- Familiarity with LOLBin techniques and associated MITRE ATT&CK TTPs
- Knowledge of common native utilities (cmd.exe, PowerShell, WMI, BASH, schtasks.exe, certutil.exe, etc.)
- Ability to access and analyze command-line arguments and execution context
- Tools for manual analysis and controlled simulation of command line execution
- Access to threat intelligence platforms (TIPs) and malware/IOC repositories

## Roles and Responsibilities

| Role                          | Responsibility                                                                                                                                                                                                                                                         |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst                   | Investigate suspicious command-line executions.Differentiate between benign, suspicious, and malicious usage based on context.Coordinate with IR team for confirmed malicious activity.Document findings for reporting and threat intelligence enrichment. |
| SOC Manager                   | Gather metrics for reporting.                                                                                                                                                                                                                                          |
| Incident Response (IR) Team   | Assist in forensic analysis if command execution is part of a broader attack.Contain and remediate impacted systems as needed.                                                                                                                                     |
| Threat Intelligence (TI) Team | Provide enrichment on known LOLBin abuses and relevant threat actor TTPs.                                                                                                                                                                                              |
| Security Engineering Team     | Adjust detection logic based on investigative findings to improve coverage.                                                                                                                                                                                            |

## Procedure Steps

### 1. Alert Intake & Initial Review
- Review the alert generated by EDR or security monitoring tools.
- If necessary, create a ticket for tracking.
- Gather key details:
	- The executable (e.g., cmd.exe, powershell.exe, wmic.exe)
	- Command-line arguments passed
	- User context (administrator vs. standard user)
	- Parent process and process tree
	- Source and destination IP addresses (if applicable)
	- Targeted files, registries, or systems
### 2. Assess Baseline Behavior
Determine if the usage is consistent with:
- Expected behavior for the user's role or department.
- Expected behavior given the endpoint purpose.
- Legitimate administrative scripts or automation tools.
	- Check for occurrence of similar activity across the environment
- Cross-reference with historical baselines for the user, host, or process.
### 3. Detailed Command Line Analysis
Decompose and review command-line arguments:
- Research the base executable to understand optional arguments.
- Look for unusual flags, obfuscated text, encoded commands (e.g., Base64 in PowerShell)
- Identify sensitive operations (e.g., password dumping, scheduled task creation, system reconnaissance)
- Decode or de-obfuscate any suspicious encoded content.
### 4. Manual Execution Simulation (If Necessary)
In a secure and isolated test environment, simulate the command execution manually.
Observe system behavior:
- Files created or modified
- Processes spawned
- Network connections initiated
- Persistence mechanisms established
### 5. Contextual Threat Analysis
Investigate:
- Parent and child processes linked to the suspicious command.
- Network activity associated with the command.
- Endpoint file system or registry modifications.
Correlate with other telemetry:
- User authentication logs
- VPN or remote access activity
- Recent phishing attempts or social engineering reports
### 6. Threat Intelligence Correlation
Search TIPs and malware databases for:
- Known uses of the command or technique by threat actors.
- Existing Indicators of Compromise (IOCs) associated with the behavior.
### 7. Determine Maliciousness & Risk
Classify the command execution as:
- Benign (legitimate IT operation or user task)
- Suspicious (unusual but not clearly malicious)
- Malicious (confirmed abuse for attack purposes)
### 8. Response Actions
For benign/suspicious but unresolved cases:
- Continue monitoring affected endpoints.
- Raise awareness with IT/Operations if necessary.
For malicious cases:
- Isolate affected endpoints.
- Escalate to the IR team for full investigation and containment.
- Review other endpoints for lateral movement or persistence techniques.
### 9. Documentation & Reporting
Fully document:
- Command line details and decoded/parsed outputs.
- Investigation steps taken.
- Contextual analysis and risk determination.
- Remediation actions and lessons learned.
### 10. Lessons Learned & Detection Improvements
- Review detection rules to:
	- Enhance logic for suspicious command-line arguments.
	- Add coverage for obfuscated or encoded command detection.
- Feed findings back into TI and threat hunting efforts.

## Best Practices
- Always analyze the full process tree and not just the isolated process.
- Understand that attackers may chain LOLBins together to obscure their objectives.
- Investigate any encoded or compressed arguments aggressively.
- Cross-validate command use against user job functions.
- Leverage threat hunting playbooks to proactively search for additional instances.
- Utilize behavioral analytics over static detection when monitoring LOLBin activity.
