LOLBAS
Star

LOLBAS Logo

Living Off The Land Binaries, Scripts and Libraries

For more info on the project, click on the logo.

If you want to contribute, check out our contribution guide. Our criteria list sets out what we define as a LOLBin/Script/Lib. More information on programmatically accesssing this project can be found on the API page.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. You can see the current ATT&CK® mapping of this project on the ATT&CK® Navigator.

If you are looking for UNIX binaries, please visit gtfobins.github.io.
If you are looking for drivers, please visit loldrivers.io.

Binary Functions Type ATT&CK® Techniques
AddinUtil.exe Binaries
  • T1218
AppInstaller.exe Binaries
  • T1105
Aspnet_Compiler.exe Binaries
  • T1127
At.exe Binaries
  • T1053.002
Atbroker.exe Binaries
  • T1218
Bash.exe Binaries
  • T1202
Bitsadmin.exe Binaries
  • T1564.004
  • T1105
  • T1218
CertOC.exe Binaries
  • T1218
  • T1105
CertReq.exe Binaries
  • T1105
Certutil.exe Binaries
  • T1105
  • T1564.004
  • T1027
  • T1140
Cmd.exe Binaries
  • T1564.004
  • T1059.003
  • T1105
  • T1048.003
Cmdkey.exe Binaries
  • T1078
cmdl32.exe Binaries
  • T1105
Cmstp.exe Binaries
  • T1218.003
Colorcpl.exe Binaries
  • T1036.005
ConfigSecurityPolicy.exe Binaries
  • T1567
  • T1105
Conhost.exe Binaries
  • T1202
Control.exe Binaries
  • T1218.002
Csc.exe Binaries
  • T1127
Cscript.exe Binaries
  • T1564.004
CustomShellHost.exe Binaries
  • T1218
DataSvcUtil.exe Binaries
  • T1567
Desktopimgdownldr.exe Binaries
  • T1105
DeviceCredentialDeployment.exe Binaries
  • T1564
Dfsvc.exe Binaries
  • T1127
Diantz.exe Binaries
  • T1564.004
  • T1105
Diskshadow.exe Binaries
  • T1003.003
  • T1202
Dnscmd.exe Binaries
  • T1543.003
Esentutl.exe Binaries
  • T1105
  • T1564.004
  • T1003.003
Eventvwr.exe Binaries
  • T1548.002
Expand.exe Binaries
  • T1105
  • T1564.004
Explorer.exe Binaries
  • T1202
Extexport.exe Binaries
  • T1218
Extrac32.exe Binaries
  • T1564.004
  • T1105
Findstr.exe Binaries
  • T1564.004
  • T1552.001
  • T1105
Finger.exe Binaries
  • T1105
fltMC.exe Binaries
  • T1562.001
Forfiles.exe Binaries
  • T1202
  • T1564.004
Fsutil.exe Binaries
  • T1485
  • T1218
Ftp.exe Binaries
  • T1202
  • T1105
Gpscript.exe Binaries
  • T1218
Hh.exe Binaries
  • T1105
  • T1218.001
IMEWDBLD.exe Binaries
  • T1105
Ie4uinit.exe Binaries
  • T1218
iediagcmd.exe Binaries
  • T1218
Ieexec.exe Binaries
  • T1105
  • T1218
Ilasm.exe Binaries
  • T1127
Infdefaultinstall.exe Binaries
  • T1218
Installutil.exe Binaries
  • T1218.004
  • T1105
Jsc.exe Binaries
  • T1127
Ldifde.exe Binaries
  • T1105
Makecab.exe Binaries
  • T1564.004
  • T1105
Mavinject.exe Binaries
  • T1218.013
  • T1564.004
Microsoft.Workflow.Compiler.exe Binaries
  • T1127
Mmc.exe Binaries
  • T1218.014
MpCmdRun.exe Binaries
  • T1105
  • T1564.004
Msbuild.exe Binaries
  • T1127.001
  • T1036
Msconfig.exe Binaries
  • T1218
Msdt.exe Binaries
  • T1218
  • T1202
Msedge.exe Binaries
  • T1105
  • T1218
Mshta.exe Binaries
  • T1218.005
  • T1105
Msiexec.exe Binaries
  • T1218.007
Netsh.exe Binaries
  • T1546.007
Odbcconf.exe Binaries
  • T1218.008
OfflineScannerShell.exe Binaries
  • T1218
OneDriveStandaloneUpdater.exe Binaries
  • T1105
Pcalua.exe Binaries
  • T1202
Pcwrun.exe Binaries
  • T1218
  • T1202
Pktmon.exe Binaries
  • T1040
Pnputil.exe Binaries
  • T1547
Presentationhost.exe Binaries
  • T1218
  • T1105
Print.exe Binaries
  • T1564.004
  • T1105
PrintBrm.exe Binaries
  • T1105
  • T1564.004
Provlaunch.exe Binaries
  • T1218
Psr.exe Binaries
  • T1113
Rasautou.exe Binaries
  • T1218
rdrleakdiag.exe Binaries
  • T1003
  • T1003.001
Reg.exe Binaries
  • T1564.004
  • T1003.002
Regasm.exe Binaries
  • T1218.009
Regedit.exe Binaries
  • T1564.004
Regini.exe Binaries
  • T1564.004
Register-cimprovider.exe Binaries
  • T1218
Regsvcs.exe Binaries
  • T1218.009
Regsvr32.exe Binaries
  • T1218.010
Replace.exe Binaries
  • T1105
Rpcping.exe Binaries
  • T1003
  • T1187
Rundll32.exe Binaries
  • T1218.011
  • T1564.004
Runexehelper.exe Binaries
  • T1218
Runonce.exe Binaries
  • T1218
Runscripthelper.exe Binaries
  • T1218
Sc.exe Binaries
  • T1564.004
Schtasks.exe Binaries
  • T1053.005
Scriptrunner.exe Binaries
  • T1202
  • T1218
Setres.exe Binaries
  • T1218
SettingSyncHost.exe Binaries
  • T1218
ssh.exe Binaries
  • T1202
Stordiag.exe Binaries
  • T1218
SyncAppvPublishingServer.exe Binaries
  • T1218
Tar.exe Binaries
  • T1105
Ttdinject.exe Binaries
  • T1127
Tttracer.exe Binaries
  • T1127
  • T1003
Unregmp2.exe Binaries
  • T1202
vbc.exe Binaries
  • T1127
Verclsid.exe Binaries
  • T1218.012
Wab.exe Binaries
  • T1218
winget.exe Binaries
  • T1105
Wlrmdr.exe Binaries
  • T1202
Wmic.exe Binaries
  • T1564.004
  • T1218
WorkFolders.exe Binaries
  • T1218
Wscript.exe Binaries
  • T1564.004
Wsreset.exe Binaries
  • T1548.002
wuauclt.exe Binaries
  • T1218
Xwizard.exe Binaries
  • T1218
  • T1105
msedge_proxy.exe Binaries
  • T1105
  • T1218
msedgewebview2.exe Binaries
  • T1202
wt.exe Binaries
  • T1202
code.exe HonorableMentions
  • T1219
GfxDownloadWrapper.exe HonorableMentions
  • T1105
Advpack.dll Libraries
  • T1218.011
Desk.cpl Libraries
  • T1218.011
Dfshim.dll Libraries
  • T1127
Ieadvpack.dll Libraries
  • T1218.011
Ieframe.dll Libraries
  • T1218.011
Mshtml.dll Libraries
  • T1218.011
Pcwutl.dll Libraries
  • T1218.011
Scrobj.dll Libraries
  • T1105
Setupapi.dll Libraries
  • T1218.011
Shdocvw.dll Libraries
  • T1218.011
Shell32.dll Libraries
  • T1218.011
Shimgvw.dll Libraries
  • T1105
Syssetup.dll Libraries
  • T1218.011
Url.dll Libraries
  • T1218.011
Zipfldr.dll Libraries
  • T1218.011
Comsvcs.dll Libraries
  • T1003.001
AccCheckConsole.exe OtherMSBinaries
  • T1218
adplus.exe OtherMSBinaries
  • T1003.001
  • T1127
AgentExecutor.exe OtherMSBinaries
  • T1218
Appvlp.exe OtherMSBinaries
  • T1218
Bginfo.exe OtherMSBinaries
  • T1218
Cdb.exe OtherMSBinaries
  • T1127
coregen.exe OtherMSBinaries
  • T1055
  • T1218
Createdump.exe OtherMSBinaries
  • T1003
csi.exe OtherMSBinaries
  • T1127
DefaultPack.EXE OtherMSBinaries
  • T1218
Devinit.exe OtherMSBinaries
  • T1218.007
Devtoolslauncher.exe OtherMSBinaries
  • T1127
dnx.exe OtherMSBinaries
  • T1127
Dotnet.exe OtherMSBinaries
  • T1218
  • T1059
dsdbutil.exe OtherMSBinaries
  • T1003.003
Dump64.exe OtherMSBinaries
  • T1003.001
DumpMinitool.exe OtherMSBinaries
  • T1003.001
Dxcap.exe OtherMSBinaries
  • T1127
Excel.exe OtherMSBinaries
  • T1105
Fsi.exe OtherMSBinaries
  • T1059
FsiAnyCpu.exe OtherMSBinaries
  • T1059
Mftrace.exe OtherMSBinaries
  • T1127
Microsoft.NodejsTools.PressAnyKey.exe OtherMSBinaries
  • T1127
Msdeploy.exe OtherMSBinaries
  • T1218
MsoHtmEd.exe OtherMSBinaries
  • T1105
Mspub.exe OtherMSBinaries
  • T1105
msxsl.exe OtherMSBinaries
  • T1220
  • T1105
  • T1564
ntdsutil.exe OtherMSBinaries
  • T1003.003
OpenConsole.exe OtherMSBinaries
  • T1202
Powerpnt.exe OtherMSBinaries
  • T1105
Procdump.exe OtherMSBinaries
  • T1202
ProtocolHandler.exe OtherMSBinaries
  • T1105
rcsi.exe OtherMSBinaries
  • T1127
Remote.exe OtherMSBinaries
  • T1127
Sqldumper.exe OtherMSBinaries
  • T1003
  • T1003.001
Sqlps.exe OtherMSBinaries
  • T1218
SQLToolsPS.exe OtherMSBinaries
  • T1218
Squirrel.exe OtherMSBinaries
  • T1218
te.exe OtherMSBinaries
  • T1127
Teams.exe OtherMSBinaries
  • T1218
TestWindowRemoteAgent.exe OtherMSBinaries
  • T1048
Tracker.exe OtherMSBinaries
  • T1127
Update.exe OtherMSBinaries
  • T1218
  • T1547
  • T1070
VSDiagnostics.exe OtherMSBinaries
  • T1127
VSIISExeLauncher.exe OtherMSBinaries
  • T1218
VisualUiaVerifyNative.exe OtherMSBinaries
  • T1218
Vshadow.exe OtherMSBinaries
  • T1127
vsjitdebugger.exe OtherMSBinaries
  • T1127
Wfc.exe OtherMSBinaries
  • T1127
Winword.exe OtherMSBinaries
  • T1105
Wsl.exe OtherMSBinaries
  • T1202
devtunnel.exe OtherMSBinaries
  • T1105
vsls-agent.exe OtherMSBinaries
  • T1218
vstest.console.exe OtherMSBinaries
  • T1127
CL_LoadAssembly.ps1 Scripts
  • T1216
CL_Mutexverifiers.ps1 Scripts
  • T1216
CL_Invocation.ps1 Scripts
  • T1216
Launch-VsDevShell.ps1 Scripts
  • T1216
Manage-bde.wsf Scripts
  • T1216
Pubprn.vbs Scripts
  • T1216.001
Syncappvpublishingserver.vbs Scripts
  • T1216
UtilityFunctions.ps1 Scripts
  • T1216
winrm.vbs Scripts
  • T1216
  • T1220
Pester.bat Scripts
  • T1216
No binary matches…