https://lolbas-project.github.io/ LOLBAS Star [logo] Living Off The Land Binaries, Scripts and Libraries For more info on the project, click on the logo. If you want to contribute, check out our contribution guide. Our criteria list sets out what we define as a LOLBin/Script/Lib. More information on programmatically accesssing this project can be found on the API page. MITRE ATT&CK(r) and ATT&CK(r) are registered trademarks of The MITRE Corporation. You can see the current ATT&CK(r) mapping of this project on the ATT&CK(r) Navigator. If you are looking for UNIX binaries, please visit gtfobins.github.io . If you are looking for drivers, please visit loldrivers.io. [ ] Binary Functions Type ATT&CK(r) Techniques AppInstaller.exe * Download Binaries * T1105 Aspnet_Compiler.exe * AWL bypass Binaries * T1127 At.exe * Execute Binaries * T1053.002 Atbroker.exe * Execute Binaries * T1218 * Execute * T1202 Bash.exe * AWL bypass Binaries * Alternate data streams * T1564.004 Bitsadmin.exe * Download Binaries * T1105 * Copy * T1218 * Execute * Execute * T1218 CertOC.exe * Download Binaries * T1105 * Download * T1105 CertReq.exe * Upload Binaries * Download * T1105 * Alternate data * T1564.004 Certutil.exe streams Binaries * T1027 * Encode * T1140 * Decode * Alternate data * T1564.004 streams * T1059.003 Cmd.exe * Download Binaries * T1105 * Upload * T1048.003 Cmdkey.exe * Credentials Binaries * T1078 cmdl32.exe * Download Binaries * T1105 * Execute * T1218.003 Cmstp.exe * AWL bypass Binaries * Upload * T1567 ConfigSecurityPolicy.exe * Download Binaries * T1105 Conhost.exe * Execute Binaries * T1202 * Alternate data * T1218.002 Control.exe streams Binaries Csc.exe * Compile Binaries * T1127 * Alternate data * T1564.004 Cscript.exe streams Binaries CustomShellHost.exe * Execute Binaries * T1218 DataSvcUtil.exe * Upload Binaries * T1567 Desktopimgdownldr.exe * Download Binaries * T1105 DeviceCredentialDeployment.exe * Conceal Binaries * T1564 Dfsvc.exe * AWL bypass Binaries * T1127 * Alternate data * T1564.004 Diantz.exe streams Binaries * T1105 * Download * Dump * T1003.003 Diskshadow.exe * Execute Binaries * T1202 Dnscmd.exe * Execute Binaries * T1543.003 * Copy * T1105 * Alternate data * T1564.004 Esentutl.exe streams Binaries * T1003.003 * Download Eventvwr.exe * UAC bypass Binaries * T1548.002 * Download * Copy * T1105 Expand.exe * Alternate data Binaries * T1564.004 streams Explorer.exe * Execute Binaries * T1202 Extexport.exe * Execute Binaries * T1218 * Alternate data streams * T1564.004 Extrac32.exe * Download Binaries * T1105 * Copy * Alternate data * T1564.004 streams * T1552.001 Findstr.exe * Credentials Binaries * T1185 * Download Finger.exe * Download Binaries * T1105 fltMC.exe * Tamper Binaries * T1562.001 * Execute * T1202 Forfiles.exe * Alternate data Binaries * T1564.004 streams * Execute * T1202 Ftp.exe * Download Binaries * T1105 Gpscript.exe * Execute Binaries * T1218 * Download * T1105 Hh.exe * Execute Binaries * T1218.001 IMEWDBLD.exe * Download Binaries * T1105 Ie4uinit.exe * Execute Binaries * T1218 * Download * T1105 Ieexec.exe * Execute Binaries * T1218 Ilasm.exe * Compile Binaries * T1127 Infdefaultinstall.exe * Execute Binaries * T1218 * AWL bypass * T1218.004 Installutil.exe * Execute Binaries * T1105 * Download Jsc.exe * Compile Binaries * T1127 Ldifde.exe * Download Binaries * T1105 * Alternate data * T1564.004 Makecab.exe streams Binaries * T1105 * Download * Execute * T1218.013 Mavinject.exe * Alternate data Binaries * T1564.004 streams * Execute * T1127 Microsoft.Workflow.Compiler.exe * AWL bypass Binaries * Execute * T1218.014 Mmc.exe * UAC bypass Binaries * Download * T1105 MpCmdRun.exe * Alternate data Binaries * T1564.004 streams * AWL bypass * T1127.001 Msbuild.exe * Execute Binaries * T1036 Msconfig.exe * Execute Binaries * T1218 * Execute * T1218 Msdt.exe * AWL bypass Binaries * T1202 * Download * T1105 Msedge.exe * Execute Binaries * T1218 * Execute * Alternate data * T1218.005 Mshta.exe streams Binaries * T1105 * Download Msiexec.exe * Execute Binaries * T1218.007 Netsh.exe * Execute Binaries * T1546.007 Odbcconf.exe * Execute Binaries * T1218.008 OfflineScannerShell.exe * Execute Binaries * T1218 OneDriveStandaloneUpdater.exe * Download Binaries * T1105 Pcalua.exe * Execute Binaries * T1202 * Execute * T1218 Pcwrun.exe Binaries * T1202 Pktmon.exe * Reconnaissance Binaries * T1040 Pnputil.exe * Execute Binaries * T1547 * Execute * T1218 Presentationhost.exe * Download Binaries * T1105 * Alternate data * T1564.004 Print.exe streams Binaries * T1105 * Copy * Download * T1105 PrintBrm.exe * Alternate data Binaries * T1564.004 streams Psr.exe * Reconnaissance Binaries * T1113 Rasautou.exe * Execute Binaries * T1218 * Dump * T1003 rdrleakdiag.exe Binaries * T1003.001 * Alternate data * T1564.004 Reg.exe streams Binaries * T1003.002 * Credentials * AWL bypass * T1218.009 Regasm.exe * Execute Binaries * Alternate data * T1564.004 Regedit.exe streams Binaries * Alternate data * T1564.004 Regini.exe streams Binaries Register-cimprovider.exe * Execute Binaries * T1218 * Execute * T1218.009 Regsvcs.exe * AWL bypass Binaries * AWL bypass * T1218.010 Regsvr32.exe * Execute Binaries * Copy * T1105 Replace.exe * Download Binaries * Credentials * T1003 Rpcping.exe Binaries * T1187 * Execute * T1218.011 Rundll32.exe * Alternate data Binaries * T1564.004 streams Runexehelper.exe * Execute Binaries * T1218 Runonce.exe * Execute Binaries * T1218 Runscripthelper.exe * Execute Binaries * T1218 * Alternate data * T1564.004 Sc.exe streams Binaries Schtasks.exe * Execute Binaries * T1053.005 * Execute * T1202 Scriptrunner.exe Binaries * T1218 Setres.exe * Execute Binaries * T1218 SettingSyncHost.exe * Execute Binaries * T1218 ssh.exe * Execute Binaries * T1202 Stordiag.exe * Execute Binaries * T1218 SyncAppvPublishingServer.exe * Execute Binaries * T1218 Tar.exe * Copy Binaries * T1105 Teams.exe * Execute Binaries * T1218 Ttdinject.exe * Execute Binaries * T1127 * Execute * T1127 Tttracer.exe * Dump Binaries * T1003 Unregmp2.exe * Execute Binaries * T1202 vbc.exe * Compile Binaries * T1127 Verclsid.exe * Execute Binaries * T1218.012 Wab.exe * Execute Binaries * T1218 winget.exe * Execute Binaries * T1105 Wlrmdr.exe * Execute Binaries * T1202 * Alternate data * T1564.004 Wmic.exe streams Binaries * T1218 * Execute WorkFolders.exe * Execute Binaries * T1218 * Alternate data * T1564.004 Wscript.exe streams Binaries Wsreset.exe * UAC bypass Binaries * T1548.002 wuauclt.exe * Execute Binaries * T1218 * Execute * T1218 Xwizard.exe * Download Binaries * T1105 fsutil.exe * Tamper Binaries * T1485 msedgewebview2.exe * Execute Binaries * T1202 wt.exe * Execute Binaries * T1202 GfxDownloadWrapper.exe * Download HonorableMentions * T1105 * AWL bypass * T1218.011 Advpack.dll * Execute Libraries Desk.cpl * Execute Libraries * T1218.011 Dfshim.dll * AWL bypass Libraries * T1127 * AWL bypass * T1218.011 Ieadvpack.dll * Execute Libraries Ieframe.dll * Execute Libraries * T1218.011 Mshtml.dll * Execute Libraries * T1218.011 Pcwutl.dll * Execute Libraries * T1218.011 * AWL bypass * T1218.011 Setupapi.dll * Execute Libraries Shdocvw.dll * Execute Libraries * T1218.011 Shell32.dll * Execute Libraries * T1218.011 * AWL bypass * T1218.011 Syssetup.dll * Execute Libraries Url.dll * Execute Libraries * T1218.011 Zipfldr.dll * Execute Libraries * T1218.011 Comsvcs.dll * Dump Libraries * T1003.001 * Execute * T1218 AccCheckConsole.exe * AWL bypass OtherMSBinaries * Dump * T1003.001 adplus.exe * Execute OtherMSBinaries * T1127 AgentExecutor.exe * Execute OtherMSBinaries * T1218 Appvlp.exe * Execute OtherMSBinaries * T1218 * Execute * T1218 Bginfo.exe * AWL bypass OtherMSBinaries Cdb.exe * Execute OtherMSBinaries * T1127 * Execute * T1055 coregen.exe * AWL bypass OtherMSBinaries * T1218 Createdump.exe * Dump OtherMSBinaries * T1003 csi.exe * Execute OtherMSBinaries * T1127 DefaultPack.EXE * Execute OtherMSBinaries * T1218 Devinit.exe * Execute OtherMSBinaries * T1218.007 Devtoolslauncher.exe * Execute OtherMSBinaries * T1127 dnx.exe * Execute OtherMSBinaries * T1127 * AWL bypass * T1218 Dotnet.exe * Execute OtherMSBinaries * T1059 Dump64.exe * Dump OtherMSBinaries * T1003.001 DumpMinitool.exe * Dump OtherMSBinaries * T1003.001 Dxcap.exe * Execute OtherMSBinaries * T1127 Excel.exe * Download OtherMSBinaries * T1105 Fsi.exe * AWL bypass OtherMSBinaries * T1059 FsiAnyCpu.exe * AWL bypass OtherMSBinaries * T1059 Mftrace.exe * Execute OtherMSBinaries * T1127 Microsoft.NodejsTools.PressAnyKey.exe * Execute OtherMSBinaries * T1127 * Execute * T1218 Msdeploy.exe * AWL bypass OtherMSBinaries MsoHtmEd.exe * Download OtherMSBinaries * T1105 Mspub.exe * Download OtherMSBinaries * T1105 * Execute * T1218 msxsl.exe * AWL bypass OtherMSBinaries ntdsutil.exe * Dump OtherMSBinaries * T1003.003 OpenConsole.exe * Execute OtherMSBinaries * T1202 Powerpnt.exe * Download OtherMSBinaries * T1105 Procdump.exe * Execute OtherMSBinaries * T1202 ProtocolHandler.exe * Download OtherMSBinaries * T1105 * Execute * T1127 rcsi.exe * AWL bypass OtherMSBinaries * AWL bypass * T1127 Remote.exe * Execute OtherMSBinaries * Dump * T1003 Sqldumper.exe OtherMSBinaries * T1003.001 Sqlps.exe * Execute OtherMSBinaries * T1218 SQLToolsPS.exe * Execute OtherMSBinaries * T1218 * Download Squirrel.exe * AWL bypass OtherMSBinaries * T1218 * Execute te.exe * Execute OtherMSBinaries * T1127 * Execute * T1127 Tracker.exe * AWL bypass OtherMSBinaries * Download * T1218 Update.exe * AWL bypass OtherMSBinaries * T1547 * Execute * T1070 VSIISExeLauncher.exe * Execute OtherMSBinaries * T1218 VisualUiaVerifyNative.exe * AWL bypass OtherMSBinaries * T1218 vsjitdebugger.exe * Execute OtherMSBinaries * T1127 Wfc.exe * AWL bypass OtherMSBinaries * T1127 Winword.exe * Download OtherMSBinaries * T1105 * Execute * T1202 Wsl.exe * Download OtherMSBinaries vsls-agent.exe * Execute OtherMSBinaries * T1218 CL_LoadAssembly.ps1 * Execute Scripts * T1216 CL_Mutexverifiers.ps1 * Execute Scripts * T1216 CL_Invocation.ps1 * Execute Scripts * T1216 Launch-VsDevShell.ps1 * Execute Scripts * T1216 Manage-bde.wsf * Execute Scripts * T1216 Pubprn.vbs * Execute Scripts * T1216.001 Syncappvpublishingserver.vbs * Execute Scripts * T1216 UtilityFunctions.ps1 * Execute Scripts * T1216 * Execute * T1216 winrm.vbs * AWL bypass Scripts * T1220 Pester.bat * Execute Scripts * T1216 No binary matches...