LOLBAS

Binary	Functions	Type	ATT&CK® Techniques
AddinUtil.exe	Execute	Binaries	T1218
AppInstaller.exe	Download	Binaries	T1105
Aspnet_Compiler.exe	AWL bypass	Binaries	T1127
At.exe	Execute	Binaries	T1053.002
Atbroker.exe	Execute	Binaries	T1218
Bash.exe	Execute AWL bypass	Binaries	T1202
Bitsadmin.exe	Alternate data streams Download Copy Execute	Binaries	T1564.004 T1105 T1218
CertOC.exe	Execute Download	Binaries	T1218 T1105
CertReq.exe	Download Upload	Binaries	T1105
Certutil.exe	Download Alternate data streams Encode Decode	Binaries	T1105 T1564.004 T1027 T1140
Cmd.exe	Alternate data streams Download Upload	Binaries	T1564.004 T1059.003 T1105 T1048.003
Cmdkey.exe	Credentials	Binaries	T1078
cmdl32.exe	Download	Binaries	T1105
Cmstp.exe	Execute AWL bypass	Binaries	T1218.003
Colorcpl.exe	Copy	Binaries	T1036.005
ConfigSecurityPolicy.exe	Upload Download	Binaries	T1567 T1105
Conhost.exe	Execute	Binaries	T1202
Control.exe	Alternate data streams	Binaries	T1218.002
Csc.exe	Compile	Binaries	T1127
Cscript.exe	Alternate data streams	Binaries	T1564.004
CustomShellHost.exe	Execute	Binaries	T1218
DataSvcUtil.exe	Upload	Binaries	T1567
Desktopimgdownldr.exe	Download	Binaries	T1105
DeviceCredentialDeployment.exe	Conceal	Binaries	T1564
Dfsvc.exe	AWL bypass	Binaries	T1127
Diantz.exe	Alternate data streams Download	Binaries	T1564.004 T1105
Diskshadow.exe	Dump Execute	Binaries	T1003.003 T1202
Dnscmd.exe	Execute	Binaries	T1543.003
Esentutl.exe	Copy Alternate data streams Download	Binaries	T1105 T1564.004 T1003.003
Eventvwr.exe	UAC bypass	Binaries	T1548.002
Expand.exe	Download Copy Alternate data streams	Binaries	T1105 T1564.004
Explorer.exe	Execute	Binaries	T1202
Extexport.exe	Execute	Binaries	T1218
Extrac32.exe	Alternate data streams Download Copy	Binaries	T1564.004 T1105
Findstr.exe	Alternate data streams Credentials Download	Binaries	T1564.004 T1552.001 T1185
Finger.exe	Download	Binaries	T1105
fltMC.exe	Tamper	Binaries	T1562.001
Forfiles.exe	Execute Alternate data streams	Binaries	T1202 T1564.004
Fsutil.exe	Tamper Execute	Binaries	T1485 T1218
Ftp.exe	Execute Download	Binaries	T1202 T1105
Gpscript.exe	Execute	Binaries	T1218
Hh.exe	Download Execute	Binaries	T1105 T1218.001
IMEWDBLD.exe	Download	Binaries	T1105
Ie4uinit.exe	Execute	Binaries	T1218
iediagcmd.exe	Execute	Binaries	T1218
Ieexec.exe	Download Execute	Binaries	T1105 T1218
Ilasm.exe	Compile	Binaries	T1127
Infdefaultinstall.exe	Execute	Binaries	T1218
Installutil.exe	AWL bypass Execute Download	Binaries	T1218.004 T1105
Jsc.exe	Compile	Binaries	T1127
Ldifde.exe	Download	Binaries	T1105
Makecab.exe	Alternate data streams Download	Binaries	T1564.004 T1105
Mavinject.exe	Execute Alternate data streams	Binaries	T1218.013 T1564.004
Microsoft.Workflow.Compiler.exe	Execute AWL bypass	Binaries	T1127
Mmc.exe	Execute UAC bypass	Binaries	T1218.014
MpCmdRun.exe	Download Alternate data streams	Binaries	T1105 T1564.004
Msbuild.exe	AWL bypass Execute	Binaries	T1127.001 T1036
Msconfig.exe	Execute	Binaries	T1218
Msdt.exe	Execute AWL bypass	Binaries	T1218 T1202
Msedge.exe	Download Execute	Binaries	T1105 T1218
Mshta.exe	Execute Alternate data streams Download	Binaries	T1218.005 T1105
Msiexec.exe	Execute	Binaries	T1218.007
Netsh.exe	Execute	Binaries	T1546.007
Odbcconf.exe	Execute	Binaries	T1218.008
OfflineScannerShell.exe	Execute	Binaries	T1218
OneDriveStandaloneUpdater.exe	Download	Binaries	T1105
Pcalua.exe	Execute	Binaries	T1202
Pcwrun.exe	Execute	Binaries	T1218 T1202
Pktmon.exe	Reconnaissance	Binaries	T1040
Pnputil.exe	Execute	Binaries	T1547
Presentationhost.exe	Execute Download	Binaries	T1218 T1105
Print.exe	Alternate data streams Copy	Binaries	T1564.004 T1105
PrintBrm.exe	Download Alternate data streams	Binaries	T1105 T1564.004
Provlaunch.exe	Execute	Binaries	T1218
Psr.exe	Reconnaissance	Binaries	T1113
Rasautou.exe	Execute	Binaries	T1218
rdrleakdiag.exe	Dump	Binaries	T1003 T1003.001
Reg.exe	Alternate data streams Credentials	Binaries	T1564.004 T1003.002
Regasm.exe	AWL bypass Execute	Binaries	T1218.009
Regedit.exe	Alternate data streams	Binaries	T1564.004
Regini.exe	Alternate data streams	Binaries	T1564.004
Register-cimprovider.exe	Execute	Binaries	T1218
Regsvcs.exe	Execute AWL bypass	Binaries	T1218.009
Regsvr32.exe	AWL bypass Execute	Binaries	T1218.010
Replace.exe	Copy Download	Binaries	T1105
Rpcping.exe	Credentials	Binaries	T1003 T1187
Rundll32.exe	Execute Alternate data streams	Binaries	T1218.011 T1564.004
Runexehelper.exe	Execute	Binaries	T1218
Runonce.exe	Execute	Binaries	T1218
Runscripthelper.exe	Execute	Binaries	T1218
Sc.exe	Alternate data streams	Binaries	T1564.004
Schtasks.exe	Execute	Binaries	T1053.005
Scriptrunner.exe	Execute	Binaries	T1202 T1218
Setres.exe	Execute	Binaries	T1218
SettingSyncHost.exe	Execute	Binaries	T1218
ssh.exe	Execute	Binaries	T1202
Stordiag.exe	Execute	Binaries	T1218
SyncAppvPublishingServer.exe	Execute	Binaries	T1218
Tar.exe	Copy	Binaries	T1105
Ttdinject.exe	Execute	Binaries	T1127
Tttracer.exe	Execute Dump	Binaries	T1127 T1003
Unregmp2.exe	Execute	Binaries	T1202
vbc.exe	Compile	Binaries	T1127
Verclsid.exe	Execute	Binaries	T1218.012
Wab.exe	Execute	Binaries	T1218
winget.exe	Execute	Binaries	T1105
Wlrmdr.exe	Execute	Binaries	T1202
Wmic.exe	Alternate data streams Execute	Binaries	T1564.004 T1218
WorkFolders.exe	Execute	Binaries	T1218
Wscript.exe	Alternate data streams	Binaries	T1564.004
Wsreset.exe	UAC bypass	Binaries	T1548.002
wuauclt.exe	Execute	Binaries	T1218
Xwizard.exe	Execute Download	Binaries	T1218 T1105
msedge_proxy.exe	Download Execute	Binaries	T1105 T1218
msedgewebview2.exe	Execute	Binaries	T1202
wt.exe	Execute	Binaries	T1202
code.exe	Execute	HonorableMentions	T1219
GfxDownloadWrapper.exe	Download	HonorableMentions	T1105
Advpack.dll	AWL bypass Execute	Libraries	T1218.011
Desk.cpl	Execute	Libraries	T1218.011
Dfshim.dll	AWL bypass	Libraries	T1127
Ieadvpack.dll	AWL bypass Execute	Libraries	T1218.011
Ieframe.dll	Execute	Libraries	T1218.011
Mshtml.dll	Execute	Libraries	T1218.011
Pcwutl.dll	Execute	Libraries	T1218.011
Scrobj.dll	Download	Libraries	T1105
Setupapi.dll	AWL bypass Execute	Libraries	T1218.011
Shdocvw.dll	Execute	Libraries	T1218.011
Shell32.dll	Execute	Libraries	T1218.011
Shimgvw.dll	Download	Libraries	T1105
Syssetup.dll	AWL bypass Execute	Libraries	T1218.011
Url.dll	Execute	Libraries	T1218.011
Zipfldr.dll	Execute	Libraries	T1218.011
Comsvcs.dll	Dump	Libraries	T1003.001
AccCheckConsole.exe	Execute AWL bypass	OtherMSBinaries	T1218
adplus.exe	Dump Execute	OtherMSBinaries	T1003.001 T1127
AgentExecutor.exe	Execute	OtherMSBinaries	T1218
Appvlp.exe	Execute	OtherMSBinaries	T1218
Bginfo.exe	Execute AWL bypass	OtherMSBinaries	T1218
Cdb.exe	Execute	OtherMSBinaries	T1127
coregen.exe	Execute AWL bypass	OtherMSBinaries	T1055 T1218
Createdump.exe	Dump	OtherMSBinaries	T1003
csi.exe	Execute	OtherMSBinaries	T1127
DefaultPack.EXE	Execute	OtherMSBinaries	T1218
Devinit.exe	Execute	OtherMSBinaries	T1218.007
Devtoolslauncher.exe	Execute	OtherMSBinaries	T1127
dnx.exe	Execute	OtherMSBinaries	T1127
Dotnet.exe	AWL bypass Execute	OtherMSBinaries	T1218 T1059
dsdbutil.exe	Dump	OtherMSBinaries	T1003.003
Dump64.exe	Dump	OtherMSBinaries	T1003.001
DumpMinitool.exe	Dump	OtherMSBinaries	T1003.001
Dxcap.exe	Execute	OtherMSBinaries	T1127
Excel.exe	Download	OtherMSBinaries	T1105
Fsi.exe	AWL bypass	OtherMSBinaries	T1059
FsiAnyCpu.exe	AWL bypass	OtherMSBinaries	T1059
Mftrace.exe	Execute	OtherMSBinaries	T1127
Microsoft.NodejsTools.PressAnyKey.exe	Execute	OtherMSBinaries	T1127
Msdeploy.exe	Execute AWL bypass	OtherMSBinaries	T1218
MsoHtmEd.exe	Download	OtherMSBinaries	T1105
Mspub.exe	Download	OtherMSBinaries	T1105
msxsl.exe	Execute AWL bypass Download Alternate data streams	OtherMSBinaries	T1220 T1105 T1564
ntdsutil.exe	Dump	OtherMSBinaries	T1003.003
OpenConsole.exe	Execute	OtherMSBinaries	T1202
Powerpnt.exe	Download	OtherMSBinaries	T1105
Procdump.exe	Execute	OtherMSBinaries	T1202
ProtocolHandler.exe	Download	OtherMSBinaries	T1105
rcsi.exe	Execute AWL bypass	OtherMSBinaries	T1127
Remote.exe	AWL bypass Execute	OtherMSBinaries	T1127
Sqldumper.exe	Dump	OtherMSBinaries	T1003 T1003.001
Sqlps.exe	Execute	OtherMSBinaries	T1218
SQLToolsPS.exe	Execute	OtherMSBinaries	T1218
Squirrel.exe	Download AWL bypass Execute	OtherMSBinaries	T1218
te.exe	Execute	OtherMSBinaries	T1127
Teams.exe	Execute	OtherMSBinaries	T1218
TestWindowRemoteAgent.exe	Upload	OtherMSBinaries	T1048
Tracker.exe	Execute AWL bypass	OtherMSBinaries	T1127
Update.exe	Download AWL bypass Execute	OtherMSBinaries	T1218 T1547 T1070
VSDiagnostics.exe	Execute	OtherMSBinaries	T1127
VSIISExeLauncher.exe	Execute	OtherMSBinaries	T1218
VisualUiaVerifyNative.exe	AWL bypass	OtherMSBinaries	T1218
Vshadow.exe	Execute	OtherMSBinaries	T1127
vsjitdebugger.exe	Execute	OtherMSBinaries	T1127
Wfc.exe	AWL bypass	OtherMSBinaries	T1127
Winword.exe	Download	OtherMSBinaries	T1105
Wsl.exe	Execute Download	OtherMSBinaries	T1202
devtunnel.exe	Download	OtherMSBinaries	T1105
vsls-agent.exe	Execute	OtherMSBinaries	T1218
vstest.console.exe	AWL bypass	OtherMSBinaries	T1127
CL_LoadAssembly.ps1	Execute	Scripts	T1216
CL_Mutexverifiers.ps1	Execute	Scripts	T1216
CL_Invocation.ps1	Execute	Scripts	T1216
Launch-VsDevShell.ps1	Execute	Scripts	T1216
Manage-bde.wsf	Execute	Scripts	T1216
Pubprn.vbs	Execute	Scripts	T1216.001
Syncappvpublishingserver.vbs	Execute	Scripts	T1216
UtilityFunctions.ps1	Execute	Scripts	T1216
winrm.vbs	Execute AWL bypass	Scripts	T1216 T1220
Pester.bat	Execute	Scripts	T1216
No binary matches…

LOLBAS
Star

Living Off The Land Binaries, Scripts and Libraries

LOLBAS Star

Living Off The Land Binaries, Scripts and Libraries

LOLBAS
Star