LOLBAS
Star

Living Off The Land Binaries, Scripts and Libraries

For more info on the project, click on the logo.

If you want to contribute, check out our contribution guide. Our criteria list sets out what we define as a LOLBin/Script/Lib.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. You can see the current ATT&CK® mapping of this project on the ATT&CK® Navigator.

If you are looking for UNIX binaries, please visit gtfobins.github.io.

Binary Functions Type ATT&CK® Techniques
AppInstaller.exe Binaries
  • T1105
Aspnet_Compiler.exe Binaries
  • T1127
At.exe Binaries
  • T1053.002
Atbroker.exe Binaries
  • T1218
Bash.exe Binaries
  • T1202
Bitsadmin.exe Binaries
  • T1564.004
  • T1105
  • T1218
CertOC.exe Binaries
  • T1218
  • T1105
CertReq.exe Binaries
  • T1105
Certutil.exe Binaries
  • T1105
  • T1564.004
  • T1027
  • T1140
Cmd.exe Binaries
  • T1059.003
Cmdkey.exe Binaries
  • T1078
cmdl32.exe Binaries
  • T1105
Cmstp.exe Binaries
  • T1218.003
ConfigSecurityPolicy.exe Binaries
  • T1567
Control.exe Binaries
  • T1218.002
Csc.exe Binaries
  • T1127
Cscript.exe Binaries
  • T1564.004
DataSvcUtil.exe Binaries
  • T1567
Desktopimgdownldr.exe Binaries
  • T1105
Dfsvc.exe Binaries
  • T1127
Diantz.exe Binaries
  • T1564.004
  • T1105
Diskshadow.exe Binaries
  • T1003.003
  • T1202
Dllhost.exe Binaries
  • T1546.015
Dnscmd.exe Binaries
  • T1543.003
Esentutl.exe Binaries
  • T1105
  • T1564.004
  • T1003.003
Eventvwr.exe Binaries
  • T1548.002
Expand.exe Binaries
  • T1105
  • T1564.004
Explorer.exe Binaries
  • T1202
Extexport.exe Binaries
  • T1218
Extrac32.exe Binaries
  • T1564.004
  • T1105
Findstr.exe Binaries
  • T1564.004
  • T1552.001
  • T1185
Finger.exe Binaries
  • T1105
fltMC.exe Binaries
  • T1562.001
Forfiles.exe Binaries
  • T1202
  • T1564.004
Ftp.exe Binaries
  • T1202
  • T1105
GfxDownloadWrapper.exe Binaries
  • T1105
Gpscript.exe Binaries
  • T1218
Hh.exe Binaries
  • T1105
  • T1218.001
IMEWDBLD.exe Binaries
  • T1105
Ie4uinit.exe Binaries
  • T1218
Ieexec.exe Binaries
  • T1105
  • T1218
Ilasm.exe Binaries
  • T1127
Infdefaultinstall.exe Binaries
  • T1218
Installutil.exe Binaries
  • T1218.004
Jsc.exe Binaries
  • T1127
Makecab.exe Binaries
  • T1564.004
  • T1105
Mavinject.exe Binaries
  • T1218.013
  • T1564.004
Microsoft.Workflow.Compiler.exe Binaries
  • T1127
Mmc.exe Binaries
  • T1218.014
MpCmdRun.exe Binaries
  • T1105
  • T1564.004
Msbuild.exe Binaries
  • T1127.001
Msconfig.exe Binaries
  • T1218
Msdt.exe Binaries
  • T1218
Mshta.exe Binaries
  • T1218.005
Msiexec.exe Binaries
  • T1218.007
Netsh.exe Binaries
  • T1546.007
Odbcconf.exe Binaries
  • T1218.008
OfflineScannerShell.exe Binaries
  • T1218
OneDriveStandaloneUpdater.exe Binaries
  • T1105
Pcalua.exe Binaries
  • T1202
Pcwrun.exe Binaries
  • T1218
Pktmon.exe Binaries
  • T1040
Pnputil.exe Binaries
  • T1547
Presentationhost.exe Binaries
  • T1218
Print.exe Binaries
  • T1564.004
  • T1105
PrintBrm.exe Binaries
  • T1105
  • T1564.004
Psr.exe Binaries
  • T1113
Rasautou.exe Binaries
  • T1218
Reg.exe Binaries
  • T1564.004
  • T1003.002
Regasm.exe Binaries
  • T1218.009
Regedit.exe Binaries
  • T1564.004
Regini.exe Binaries
  • T1564.004
Register-cimprovider.exe Binaries
  • T1218
Regsvcs.exe Binaries
  • T1218.009
Regsvr32.exe Binaries
  • T1218.010
Replace.exe Binaries
  • T1105
Rpcping.exe Binaries
  • T1003
  • T1187
Rundll32.exe Binaries
  • T1218.011
  • T1564.004
Runonce.exe Binaries
  • T1218
Runscripthelper.exe Binaries
  • T1218
Sc.exe Binaries
  • T1564.004
Schtasks.exe Binaries
  • T1053.005
Scriptrunner.exe Binaries
  • T1202
  • T1218
SettingSyncHost.exe Binaries
  • T1218
Stordiag.exe Binaries
  • T1218
SyncAppvPublishingServer.exe Binaries
  • T1218
Ttdinject.exe Binaries
  • T1127
Tttracer.exe Binaries
  • T1127
  • T1003
vbc.exe Binaries
  • T1127
Verclsid.exe Binaries
  • T1218.012
Wab.exe Binaries
  • T1218
Wmic.exe Binaries
  • T1564.004
  • T1218
WorkFolders.exe Binaries
  • T1218
Wscript.exe Binaries
  • T1564.004
Wsreset.exe Binaries
  • T1548.002
wuauclt.exe Binaries
  • T1218
Xwizard.exe Binaries
  • T1218
  • T1105
Advpack.dll Libraries
  • T1218.011
Dfshim.dll Libraries
  • T1127
Ieadvpack.dll Libraries
  • T1218.011
Ieaframe.dll Libraries
  • T1218.011
Mshtml.dll Libraries
  • T1218.011
Pcwutl.dll Libraries
  • T1218.011
Setupapi.dll Libraries
  • T1218.011
Shdocvw.dll Libraries
  • T1218.011
Shell32.dll Libraries
  • T1218.011
Syssetup.dll Libraries
  • T1218.011
Url.dll Libraries
  • T1218.011
Zipfldr.dll Libraries
  • T1218.011
Comsvcs.dll Libraries
  • T1003.001
adplus.exe OtherMSBinaries
  • T1003.001
AgentExecutor.exe OtherMSBinaries
  • T1218
Appvlp.exe OtherMSBinaries
  • T1218
Bginfo.exe OtherMSBinaries
  • T1218
Cdb.exe OtherMSBinaries
  • T1127
coregen.exe OtherMSBinaries
  • T1055
  • T1218
csi.exe OtherMSBinaries
  • T1127
DefaultPack.EXE OtherMSBinaries
  • T1218
Devtoolslauncher.exe OtherMSBinaries
  • T1127
dnx.exe OtherMSBinaries
  • T1127
Dotnet.exe OtherMSBinaries
  • T1218
Dxcap.exe OtherMSBinaries
  • T1127
Excel.exe OtherMSBinaries
  • T1105
Fsi.exe OtherMSBinaries
  • T1059
FsiAnyCpu.exe OtherMSBinaries
  • T1059
Mftrace.exe OtherMSBinaries
  • T1127
Msdeploy.exe OtherMSBinaries
  • T1218
msxsl.exe OtherMSBinaries
  • T1218
ntdsutil.exe OtherMSBinaries
  • T1003.003
Powerpnt.exe OtherMSBinaries
  • T1105
Procdump(64).exe OtherMSBinaries
  • T1202
rcsi.exe OtherMSBinaries
  • T1127
Remote.exe OtherMSBinaries
  • T1127
Sqldumper.exe OtherMSBinaries
  • T1003
  • T1003.001
Sqlps.exe OtherMSBinaries
  • T1218
SQLToolsPS.exe OtherMSBinaries
  • T1218
Squirrel.exe OtherMSBinaries
  • T1218
te.exe OtherMSBinaries
  • T1127
Tracker.exe OtherMSBinaries
  • T1127
Update.exe OtherMSBinaries
  • T1218
  • T1547
  • T1070
VSIISExeLauncher.exe OtherMSBinaries
  • T1218
VisualUiaVerifyNative.exe OtherMSBinaries
  • T1218
vsjitdebugger.exe OtherMSBinaries
  • T1127
Wfc.exe OtherMSBinaries
  • T1127
Winword.exe OtherMSBinaries
  • T1105
Wsl.exe OtherMSBinaries
  • T1202
CL_LoadAssembly.ps1 Scripts
  • T1216
CL_Mutexverifiers.ps1 Scripts
  • T1216
CL_Invocation.ps1 Scripts
  • T1216
Manage-bde.wsf Scripts
  • T1216
Pubprn.vbs Scripts
  • T1216.001
Syncappvpublishingserver.vbs Scripts
  • T1216
UtilityFunctions.ps1 Scripts
  • T1216
winrm.vbs Scripts
  • T1216
Pester.bat Scripts
  • T1216
No binary matches…