LOLBAS
Star

LOLBAS Logo

Living Off The Land Binaries, Scripts and Libraries

For more info on the project, click on the logo.

If you want to contribute, check out our contribution guide. Our criteria list sets out what we define as a LOLBin/Script/Lib. More information on programmatically accesssing this project can be found on the API page.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. You can see the current ATT&CK® mapping of this project on the ATT&CK® Navigator.

If you are looking for UNIX binaries, please visit gtfobins.github.io.
If you are looking for drivers, please visit loldrivers.io.

Binary Functions Type ATT&CK® Techniques
AddinUtil.exe Binaries
T1218
AppInstaller.exe Binaries
T1105
Aspnet_Compiler.exe Binaries
T1127
At.exe Binaries
T1053.002
Atbroker.exe Binaries
T1218
Bash.exe Binaries
T1202
Bitsadmin.exe Binaries
T1564.004
T1105
T1218
CertOC.exe Binaries
T1218
T1105
CertReq.exe Binaries
T1105
Certutil.exe Binaries
T1105
T1564.004
T1027.013
T1140
Cmd.exe Binaries
T1564.004
T1059.003
T1105
T1048.003
Cmdkey.exe Binaries
T1078
cmdl32.exe Binaries
T1105
Cmstp.exe Binaries
T1218.003
Colorcpl.exe Binaries
T1036.005
ComputerDefaults.exe Binaries
T1548.002
ConfigSecurityPolicy.exe Binaries
T1567
T1105
Conhost.exe Binaries
T1202
Control.exe Binaries
T1218.002
Csc.exe Binaries
T1127
Cscript.exe Binaries
T1564.004
CustomShellHost.exe Binaries
T1218
DataSvcUtil.exe Binaries
T1567
Desktopimgdownldr.exe Binaries
T1105
DeviceCredentialDeployment.exe Binaries
T1564
Dfsvc.exe Binaries
T1127
Diantz.exe Binaries
T1564.004
T1105
T1036
Diskshadow.exe Binaries
T1003.003
T1202
Dnscmd.exe Binaries
T1543.003
Esentutl.exe Binaries
T1105
T1564.004
T1003.003
Eventvwr.exe Binaries
T1548.002
Expand.exe Binaries
T1105
T1564.004
Explorer.exe Binaries
T1202
Extexport.exe Binaries
T1218
Extrac32.exe Binaries
T1564.004
T1105
Findstr.exe Binaries
T1564.004
T1552.001
T1105
Finger.exe Binaries
T1105
fltMC.exe Binaries
T1562.001
Forfiles.exe Binaries
T1202
T1564.004
Fsutil.exe Binaries
T1485
T1218
Ftp.exe Binaries
T1202
T1105
Gpscript.exe Binaries
T1218
Hh.exe Binaries
T1105
T1218.001
IMEWDBLD.exe Binaries
T1105
Ie4uinit.exe Binaries
T1218
iediagcmd.exe Binaries
T1218
Ieexec.exe Binaries
T1105
T1218
Ilasm.exe Binaries
T1127
Infdefaultinstall.exe Binaries
T1218
Installutil.exe Binaries
T1218.004
T1105
Jsc.exe Binaries
T1127
Ldifde.exe Binaries
T1105
Makecab.exe Binaries
T1564.004
T1105
T1036
Mavinject.exe Binaries
T1218.013
T1564.004
Microsoft.Workflow.Compiler.exe Binaries
T1127
Mmc.exe Binaries
T1218.014
MpCmdRun.exe Binaries
T1105
T1564.004
Msbuild.exe Binaries
T1127.001
T1036
Msconfig.exe Binaries
T1218
Msdt.exe Binaries
T1218
T1202
Msedge.exe Binaries
T1105
T1218.015
Mshta.exe Binaries
T1218.005
T1105
Msiexec.exe Binaries
T1218.007
Netsh.exe Binaries
T1546.007
Ngen.exe Binaries
T1105
Odbcconf.exe Binaries
T1218.008
OfflineScannerShell.exe Binaries
T1218
OneDriveStandaloneUpdater.exe Binaries
T1105
Pcalua.exe Binaries
T1202
Pcwrun.exe Binaries
T1218
T1202
Pktmon.exe Binaries
T1040
Pnputil.exe Binaries
T1547
Presentationhost.exe Binaries
T1218
T1105
Print.exe Binaries
T1564.004
T1105
PrintBrm.exe Binaries
T1105
T1564.004
Provlaunch.exe Binaries
T1218
Psr.exe Binaries
T1113
Rasautou.exe Binaries
T1218
rdrleakdiag.exe Binaries
T1003
T1003.001
Reg.exe Binaries
T1564.004
T1003.002
Regasm.exe Binaries
T1218.009
Regedit.exe Binaries
T1564.004
Regini.exe Binaries
T1564.004
Register-cimprovider.exe Binaries
T1218
Regsvcs.exe Binaries
T1218.009
Regsvr32.exe Binaries
T1218.010
Replace.exe Binaries
T1105
Rpcping.exe Binaries
T1003
T1187
Rundll32.exe Binaries
T1218.011
T1564.004
Runexehelper.exe Binaries
T1218
Runonce.exe Binaries
T1218
Runscripthelper.exe Binaries
T1218
Sc.exe Binaries
T1564.004
Schtasks.exe Binaries
T1053.005
Scriptrunner.exe Binaries
T1202
T1218
Setres.exe Binaries
T1218
SettingSyncHost.exe Binaries
T1218
ssh.exe Binaries
T1202
Stordiag.exe Binaries
T1218
SyncAppvPublishingServer.exe Binaries
T1218
Tar.exe Binaries
T1564.004
T1105
Ttdinject.exe Binaries
T1127
Tttracer.exe Binaries
T1127
T1003
Unregmp2.exe Binaries
T1202
vbc.exe Binaries
T1127
Verclsid.exe Binaries
T1218.012
Wab.exe Binaries
T1218
wbadmin.exe Binaries
T1003.003
winget.exe Binaries
T1105
Wlrmdr.exe Binaries
T1202
Wmic.exe Binaries
T1564.004
T1218
T1105
WorkFolders.exe Binaries
T1218
Wscript.exe Binaries
T1564.004
Wsreset.exe Binaries
T1548.002
wuauclt.exe Binaries
T1218
Xwizard.exe Binaries
T1218
T1105
msedge_proxy.exe Binaries
T1105
T1218.015
msedgewebview2.exe Binaries
T1218.015
wt.exe Binaries
T1202
Advpack.dll Libraries
T1218.011
Desk.cpl Libraries
T1218.011
Dfshim.dll Libraries
T1127
Ieadvpack.dll Libraries
T1218.011
Ieframe.dll Libraries
T1218.011
Mshtml.dll Libraries
T1218.011
Pcwutl.dll Libraries
T1218.011
Scrobj.dll Libraries
T1105
Setupapi.dll Libraries
T1218.011
Shdocvw.dll Libraries
T1218.011
Shell32.dll Libraries
T1218.011
Shimgvw.dll Libraries
T1105
Syssetup.dll Libraries
T1218.011
Url.dll Libraries
T1218.011
Zipfldr.dll Libraries
T1218.011
Comsvcs.dll Libraries
T1003.001
AccCheckConsole.exe OtherMSBinaries
T1218
adplus.exe OtherMSBinaries
T1003.001
T1127
AgentExecutor.exe OtherMSBinaries
T1218
AppCert.exe OtherMSBinaries
T1127
T1218.007
Appvlp.exe OtherMSBinaries
T1218
Bginfo.exe OtherMSBinaries
T1218
Cdb.exe OtherMSBinaries
T1127
coregen.exe OtherMSBinaries
T1055
T1218
Createdump.exe OtherMSBinaries
T1003
csi.exe OtherMSBinaries
T1127
DefaultPack.EXE OtherMSBinaries
T1218
Devinit.exe OtherMSBinaries
T1218.007
Devtoolslauncher.exe OtherMSBinaries
T1127
dnx.exe OtherMSBinaries
T1127
Dotnet.exe OtherMSBinaries
T1218
T1059
dsdbutil.exe OtherMSBinaries
T1003.003
dtutil.exe OtherMSBinaries
T1105
Dump64.exe OtherMSBinaries
T1003.001
DumpMinitool.exe OtherMSBinaries
T1003.001
Dxcap.exe OtherMSBinaries
T1127
Excel.exe OtherMSBinaries
T1105
Fsi.exe OtherMSBinaries
T1059
FsiAnyCpu.exe OtherMSBinaries
T1059
Mftrace.exe OtherMSBinaries
T1127
Microsoft.NodejsTools.PressAnyKey.exe OtherMSBinaries
T1127
MSAccess.exe OtherMSBinaries
T1105
Msdeploy.exe OtherMSBinaries
T1218
T1105
MsoHtmEd.exe OtherMSBinaries
T1105
Mspub.exe OtherMSBinaries
T1105
msxsl.exe OtherMSBinaries
T1220
T1105
T1564
ntdsutil.exe OtherMSBinaries
T1003.003
OpenConsole.exe OtherMSBinaries
T1202
Powerpnt.exe OtherMSBinaries
T1105
Procdump.exe OtherMSBinaries
T1202
ProtocolHandler.exe OtherMSBinaries
T1105
rcsi.exe OtherMSBinaries
T1127
Remote.exe OtherMSBinaries
T1127
Sqldumper.exe OtherMSBinaries
T1003
T1003.001
Sqlps.exe OtherMSBinaries
T1218
SQLToolsPS.exe OtherMSBinaries
T1218
Squirrel.exe OtherMSBinaries
T1218
te.exe OtherMSBinaries
T1127
Teams.exe OtherMSBinaries
T1218.015
TestWindowRemoteAgent.exe OtherMSBinaries
T1048
Tracker.exe OtherMSBinaries
T1127
Update.exe OtherMSBinaries
T1218
T1547
T1070
VSDiagnostics.exe OtherMSBinaries
T1127
VSIISExeLauncher.exe OtherMSBinaries
T1218
Visio.exe OtherMSBinaries
T1105
VisualUiaVerifyNative.exe OtherMSBinaries
T1218
VSLaunchBrowser.exe OtherMSBinaries
T1105
T1127
Vshadow.exe OtherMSBinaries
T1127
vsjitdebugger.exe OtherMSBinaries
T1127
Wfc.exe OtherMSBinaries
T1127
WinProj.exe OtherMSBinaries
T1105
Winword.exe OtherMSBinaries
T1105
Wsl.exe OtherMSBinaries
T1202
T1105
devtunnel.exe OtherMSBinaries
T1105
vsls-agent.exe OtherMSBinaries
T1218
vstest.console.exe OtherMSBinaries
T1127
winfile.exe OtherMSBinaries
T1202
xsd.exe OtherMSBinaries
T1105
CL_LoadAssembly.ps1 Scripts
T1216
CL_Mutexverifiers.ps1 Scripts
T1216
CL_Invocation.ps1 Scripts
T1216
Launch-VsDevShell.ps1 Scripts
T1216
Manage-bde.wsf Scripts
T1216
Pubprn.vbs Scripts
T1216.001
Syncappvpublishingserver.vbs Scripts
T1216.002
UtilityFunctions.ps1 Scripts
T1216
winrm.vbs Scripts
T1216
T1220
Pester.bat Scripts
T1216
No binary matches…