712 indexed
LOLBINLiving-off-the-land binaries
712 binaries that adversaries abuse for malicious purposes — LOLBAS (Windows) + GTFOBins (Unix). Filter by platform. Authored by Adam Lundqvist.
Showing 1–50 of 234 in Windows · page 1 of 5
| ID | Title | Summary |
|---|---|---|
| AccCheckConsole.exe | AccCheckConsole.exe Windows | AccCheckConsole.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, AWL Bypass. Mapped ATT&CK te… |
| AddinUtil.exe | AddinUtil.exe Windows | AddinUtil.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLB… |
| adplus.exe | adplus.exe Windows | adplus.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Dump, Execute. Mapped ATT&CK techniques (per L… |
| Advpack.dll | Advpack.dll Windows | Advpack.dll is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: AWL Bypass, Execute. Mapped ATT&CK techniques… |
| AgentExecutor.exe | AgentExecutor.exe Windows | AgentExecutor.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per … |
| AppCert.exe | AppCert.exe Windows | AppCert.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS… |
| AppInstaller.exe | AppInstaller.exe Windows | AppInstaller.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download. Mapped ATT&CK techniques (per … |
| AppLauncher.exe | AppLauncher.exe Windows | AppLauncher.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LO… |
| Appvlp.exe | Appvlp.exe Windows | Appvlp.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS … |
| Aspnet_Compiler.exe | Aspnet_Compiler.exe Windows | Aspnet_Compiler.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: AWL Bypass. Mapped ATT&CK techniques … |
| At.exe | At.exe Windows | At.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / GT… |
| Atbroker.exe | Atbroker.exe Windows | Atbroker.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBA… |
| Bash.exe | Bash.exe Windows | Bash.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, AWL Bypass. Mapped ATT&CK techniques (p… |
| Bcp.exe | Bcp.exe Windows | Bcp.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download. Mapped ATT&CK techniques (per LOLBAS / … |
| Bginfo.exe | Bginfo.exe Windows | Bginfo.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, AWL Bypass. Mapped ATT&CK techniques … |
| Bitsadmin.exe | Bitsadmin.exe Windows | Bitsadmin.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: ADS, Download, Copy, Execute. Mapped ATT&CK… |
| Cdb.exe | Cdb.exe Windows | Cdb.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / G… |
| CertOC.exe | CertOC.exe Windows | CertOC.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, Download. Mapped ATT&CK techniques (p… |
| CertReq.exe | CertReq.exe Windows | CertReq.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download, Upload. Mapped ATT&CK techniques (p… |
| Certutil.exe | Certutil.exe Windows | Certutil.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download, ADS, Encode, Decode. Mapped ATT&CK… |
| Change.exe | Change.exe Windows | Change.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS … |
| Cipher.exe | Cipher.exe Windows | Cipher.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Tamper. Mapped ATT&CK techniques (per LOLBAS /… |
| CL_Invocation.ps1 | CL_Invocation.ps1 Windows | CL_Invocation.ps1 is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per … |
| CL_LoadAssembly.ps1 | CL_LoadAssembly.ps1 Windows | CL_LoadAssembly.ps1 is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (pe… |
| CL_Mutexverifiers.ps1 | CL_Mutexverifiers.ps1 Windows | CL_Mutexverifiers.ps1 is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (… |
| Cmd.exe | Cmd.exe Windows | Cmd.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: ADS, Download, Upload. Mapped ATT&CK techniques (… |
| Cmdkey.exe | Cmdkey.exe Windows | Cmdkey.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Credentials. Mapped ATT&CK techniques (per LOL… |
| cmdl32.exe | cmdl32.exe Windows | cmdl32.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download. Mapped ATT&CK techniques (per LOLBAS… |
| Cmstp.exe | Cmstp.exe Windows | Cmstp.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, AWL Bypass. Mapped ATT&CK techniques (… |
| Colorcpl.exe | Colorcpl.exe Windows | Colorcpl.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Copy. Mapped ATT&CK techniques (per LOLBAS /… |
| ComputerDefaults.exe | ComputerDefaults.exe Windows | ComputerDefaults.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: UAC Bypass. Mapped ATT&CK techniques… |
| Comsvcs.dll | Comsvcs.dll Windows | Comsvcs.dll is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Dump. Mapped ATT&CK techniques (per LOLBAS / … |
| ConfigSecurityPolicy.exe | ConfigSecurityPolicy.exe Windows | ConfigSecurityPolicy.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Upload, Download. Mapped ATT&CK … |
| Conhost.exe | Conhost.exe Windows | Conhost.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS… |
| Control.exe | Control.exe Windows | Control.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: ADS, Execute. Mapped ATT&CK techniques (per L… |
| coregen.exe | coregen.exe Windows | coregen.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, AWL Bypass. Mapped ATT&CK techniques… |
| Createdump.exe | Createdump.exe Windows | Createdump.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Dump. Mapped ATT&CK techniques (per LOLBAS… |
| Csc.exe | Csc.exe Windows | Csc.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Compile. Mapped ATT&CK techniques (per LOLBAS / G… |
| Cscript.exe | Cscript.exe Windows | Cscript.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: ADS. Mapped ATT&CK techniques (per LOLBAS / G… |
| csi.exe | csi.exe Windows | csi.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / G… |
| CustomShellHost.exe | CustomShellHost.exe Windows | CustomShellHost.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (pe… |
| DataSvcUtil.exe | DataSvcUtil.exe Windows | DataSvcUtil.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Upload. Mapped ATT&CK techniques (per LOL… |
| DefaultPack.EXE | DefaultPack.EXE Windows | DefaultPack.EXE is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LO… |
| Desk.cpl | Desk.cpl Windows | Desk.cpl is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / … |
| Desktopimgdownldr.exe | Desktopimgdownldr.exe Windows | Desktopimgdownldr.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download. Mapped ATT&CK techniques … |
| DeviceCredentialDeployment.exe | DeviceCredentialDeployment.exe Windows | DeviceCredentialDeployment.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Conceal. Mapped ATT&CK tec… |
| Devinit.exe | Devinit.exe Windows | Devinit.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS… |
| Devtoolslauncher.exe | Devtoolslauncher.exe Windows | Devtoolslauncher.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (p… |
| devtunnel.exe | devtunnel.exe Windows | devtunnel.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Download. Mapped ATT&CK techniques (per LOL… |
| Dfshim.dll | Dfshim.dll Windows | Dfshim.dll is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: AWL Bypass. Mapped ATT&CK techniques (per LOLB… |