LOLBAS
Living Off The Land Binaries, Scripts and Libraries — Windows binaries signed by Microsoft that can be used by attackers to bypass application control solutions.
The goal of the project is to document every binary, script and library that can be used for Living Off The Land techniques.
Categories
Filter
Search among 235 binaries: [<name>]/[<category>]
- AccCheckConsole.exe Execute AWL Bypass
- AddinUtil.exe Execute
- adplus.exe Dump Execute
- Advpack.dll AWL Bypass Execute
- AgentExecutor.exe Execute
- AppCert.exe Execute
- AppInstaller.exe Download
- AppLauncher.exe Execute
- Appvlp.exe Execute
- Aspnet_Compiler.exe AWL Bypass
- At.exe Execute
- Atbroker.exe Execute
- Bash.exe Execute AWL Bypass
- Bcp.exe Download
- Bginfo.exe Execute AWL Bypass
- Bitsadmin.exe ADS Download Copy Execute
- Cdb.exe Execute
- CertOC.exe Execute Download
- CertReq.exe Download Upload
- Certutil.exe Download ADS Encode Decode
- Change.exe Execute
- Cipher.exe Tamper
- CL_Invocation.ps1 Execute
- CL_LoadAssembly.ps1 Execute
- CL_Mutexverifiers.ps1 Execute
- Cmd.exe ADS Download Upload
- Cmdkey.exe Credentials
- cmdl32.exe Download
- Cmstp.exe Execute AWL Bypass
- code.exe Execute
- Colorcpl.exe Copy
- ComputerDefaults.exe UAC Bypass
- Comsvcs.dll Dump
- ConfigSecurityPolicy.exe Upload Download
- Conhost.exe Execute
- Control.exe ADS Execute
- coregen.exe Execute AWL Bypass
- Createdump.exe Dump
- Csc.exe Compile
- Cscript.exe ADS
- csi.exe Execute
- CustomShellHost.exe Execute
- DataSvcUtil.exe Upload
- DefaultPack.EXE Execute
- Desk.cpl Execute
- Desktopimgdownldr.exe Download
- DeviceCredentialDeployment.exe Conceal
- Devinit.exe Execute
- Devtoolslauncher.exe Execute
- devtunnel.exe Download
- Dfshim.dll AWL Bypass
- Dfsvc.exe AWL Bypass
- Diantz.exe ADS Download Execute
- Diskshadow.exe Dump Execute
- Dnscmd.exe Execute
- dnx.exe Execute
- Dotnet.exe AWL Bypass Execute
- dsdbutil.exe Dump
- dtutil.exe Copy
- Dump64.exe Dump
- DumpMinitool.exe Dump
- Dxcap.exe Execute
- ECMangen.exe Download
- Esentutl.exe Copy ADS Download
- Eudcedit.exe UAC Bypass
- Eventvwr.exe UAC Bypass
- Excel.exe Download
- Expand.exe Download Copy ADS
- Explorer.exe Execute
- Extexport.exe Execute
- Extrac32.exe ADS Download Copy
- Findstr.exe ADS Credentials Download
- Finger.exe Download
- fltMC.exe Tamper
- Forfiles.exe Execute ADS
- Fsi.exe AWL Bypass
- FsiAnyCpu.exe AWL Bypass
- Fsutil.exe Tamper Execute
- Ftp.exe Execute Download
- GfxDownloadWrapper.exe Download
- Gpscript.exe Execute
- Hh.exe Download Execute
- Ie4uinit.exe Execute
- Ieadvpack.dll AWL Bypass Execute
- iediagcmd.exe Execute
- Ieexec.exe Download Execute
- Ieframe.dll Execute
- Ilasm.exe Compile
- IMEWDBLD.exe Download
- Infdefaultinstall.exe Execute
- Installutil.exe AWL Bypass Execute Download
- IntelliTrace.exe Execute
- iscsicpl.exe UAC Bypass
- Jsc.exe Compile
- Launch-VsDevShell.ps1 Execute
- Ldifde.exe Download
- Logger.exe Execute
- Makecab.exe ADS Download Execute
- Manage-bde.wsf Execute
- Mavinject.exe Execute ADS
- Mftrace.exe Execute
- Microsoft.NodejsTools.PressAnyKey.exe Execute
- Microsoft.Workflow.Compiler.exe Execute AWL Bypass
- Mmc.exe Execute UAC Bypass Download
- MpCmdRun.exe Download ADS
- Mpiexec.exe Execute
- MSAccess.exe Download
- Msbuild.exe AWL Bypass Execute
- Msconfig.exe Execute
- Msdeploy.exe Execute AWL Bypass Copy
- Msdt.exe Execute AWL Bypass
- Msedge.exe Download Execute
- msedge_proxy.exe Download Execute
- msedgewebview2.exe Execute
- Mshta.exe Execute ADS Download
- Mshtml.dll Execute
- Msiexec.exe Execute
- MsoHtmEd.exe Download
- Mspub.exe Download
- msxsl.exe Execute AWL Bypass Download ADS
- Netsh.exe Execute
- Ngen.exe Download
- Nmcap.exe Reconnaissance
- ntdsutil.exe Dump
- Ntsd.exe Execute
- odbcad32.exe UAC Bypass
- Odbcconf.exe Execute
- OfflineScannerShell.exe Execute
- OneDriveStandaloneUpdater.exe Download
- OpenConsole.exe Execute
- Pcalua.exe Execute
- Pcwrun.exe Execute
- Pcwutl.dll Execute
- Pester.bat Execute
- PhotoViewer.dll Download
- Pixtool.exe Execute
- Pktmon.exe Reconnaissance
- Pnputil.exe Execute
- Powerpnt.exe Download
- Powershell.exe Execute
- Presentationhost.exe Execute Download
- Print.exe ADS Copy
- PrintBrm.exe Download ADS
- Procdump.exe Execute
- ProtocolHandler.exe Download
- Provlaunch.exe Execute
- Psr.exe Reconnaissance
- Pubprn.vbs Execute
- Query.exe Execute
- Rasautou.exe Execute
- rcsi.exe Execute AWL Bypass
- rdrleakdiag.exe Dump
- Reg.exe ADS Credentials
- Regasm.exe AWL Bypass Execute
- Regedit.exe ADS
- Regini.exe ADS
- Register-cimprovider.exe Execute
- Regsvcs.exe Execute AWL Bypass
- Regsvr32.exe AWL Bypass Execute
- Remote.exe AWL Bypass Execute
- Replace.exe Copy Download
- Reset.exe Execute
- Rpcping.exe Credentials
- Rundll32.exe Execute ADS
- Runexehelper.exe Execute
- Runonce.exe Execute
- Runscripthelper.exe Execute
- Sc.exe ADS
- Schtasks.exe Execute
- Scriptrunner.exe Execute
- Scrobj.dll Download
- Setres.exe Execute
- SettingSyncHost.exe Execute
- Setupapi.dll AWL Bypass Execute
- Sftp.exe Execute
- Shdocvw.dll Execute
- Shell32.dll Execute
- Shimgvw.dll Download
- Sigverif.exe Execute
- Sqldumper.exe Dump
- Sqlps.exe Execute
- SQLToolsPS.exe Execute
- Squirrel.exe Download AWL Bypass Execute
- ssh.exe Execute
- Stordiag.exe Execute
- SyncAppvPublishingServer.exe Execute
- Syncappvpublishingserver.vbs Execute
- Syssetup.dll AWL Bypass Execute
- Tar.exe ADS Copy
- te.exe Execute
- Teams.exe Execute
- TestWindowRemoteAgent.exe Upload
- Tracker.exe Execute AWL Bypass
- Ttdinject.exe Execute
- Tttracer.exe Execute Dump
- Unregmp2.exe Execute
- Update.exe Download AWL Bypass Execute
- Url.dll Execute
- UtilityFunctions.ps1 Execute
- vbc.exe Compile
- Verclsid.exe Execute
- Visio.exe Download
- VisualUiaVerifyNative.exe AWL Bypass
- VSDiagnostics.exe Execute
- Vshadow.exe Execute
- VSIISExeLauncher.exe Execute
- vsjitdebugger.exe Execute
- VSLaunchBrowser.exe Download Execute
- vsls-agent.exe Execute
- vstest.console.exe AWL Bypass
- Wab.exe Execute
- wbadmin.exe Dump
- wbemtest.exe Execute
- Wfc.exe AWL Bypass
- WFMFormat.exe Execute
- WinDbg.exe Execute
- winfile.exe Execute
- winget.exe Execute Download AWL Bypass
- WinProj.exe Download
- winrm.vbs Execute AWL Bypass
- Winword.exe Download
- Wlrmdr.exe Execute
- Wmic.exe ADS Execute Copy
- WorkFolders.exe Execute
- write.exe Execute
- Wscript.exe ADS
- Wsl.exe Execute Download
- Wsreset.exe UAC Bypass
- wt.exe Execute
- wuauclt.exe Execute
- XBootMgr.exe Execute
- XBootMgrSleep.exe Execute
- xsd.exe Download
- Xwizard.exe Execute Download
- Zipfldr.dll Execute