← All detection heuristics · Social Engineering
high
SE_LOLBIN_RUN_COMMAND
What it means
Extracted document text contains a Windows execution tool name within 220 characters of a dangerous flag, command verb, or URL.
Why it fires
The rule matches the name of a script/execution tool (PowerShell, cmd, mshta, rundll32, regsvr32, wscript, cscript, certutil, bitsadmin, curl, wget) within 220 characters of a dangerous flag (-enc, downloadstring, iex, /i:, javascript:, vbscript:) or a URL. This catches two distinct shapes: (1) a visible 'run this' instruction in HTML/PDF/RTF lure bodies, where the matched span really is the command a victim is asked to run; and (2) macro-laden Office files where the macro's own string-pool entries (CreateObject names, action verbs, payload URLs) end up adjacent in the extracted text. The detail field shows the head and tail of the matched span so an analyst can tell which case applies.
Other Social Engineering heuristics
SE_BOOKING_COMPLAINT_PHISH PDF_FAKE_DOCUMENT_COMPONENT_INSTALLER OOXML_QR_CREDENTIAL_PHISH SE_CALLBACK_SCAM_TEMPLATE PDF_BRAND_ACCOUNT_UPDATE_REDIRECT_LURE PDF_IMAGE_REPEATED_DECOY_REDIRECT_LURE PDF_IMAGE_DOCUMENT_REVIEW_HOST_LURE PDF_LOCALIZED_DOWNLOAD_HOSTING_LURE PDF_MINIMAL_VIEW_DOCUMENT_REDIRECT PDF_NESTED_ENCODED_CROSSHOST_REDIRECT PDF_RFP_EXTERNAL_ACTION_LURE PDF_UTILITY_REFUND_OFFDOMAIN_LURE PDF_SPARSE_MOVED_ARTICLE_DOORWAY