LOLBin Categories

Adversaries weaponize trusted operating system binaries to download external payloads, malicious scripts, and stage-2 implants without relying on web browsers or dropping suspicious third-party downloaders.

Living-off-the-Land execution utilities allow threat actors to run arbitrary shell commands, in-memory scripts, and weaponized payloads through signed system binaries, evading application blacklists.

Windows User Account Control (UAC) bypass techniques leverage auto-elevating binaries and trusted registry/environment hijacking to execute code at High or System integrity without prompting the interactive user.

Defense evasion LOLBins bypass endpoint security controls, Application Whitelisting (AppLocker/WDAC), and script restrictions by executing code through digitally signed, trusted Microsoft or Unix utilities.

Adversaries abuse built-in utilities to extract sensitive plaintext credentials, Kerberos tickets, and password hashes from operating system memory (LSASS) or local configuration stores.

Adversaries abuse native system utilities to maintain uninterrupted access across system restarts, user logoffs, and credential updates by configuring autostarts, scheduled tasks, and service registrations.

Adversaries abuse built-in command line tools to enumerate local users, domain trust relationships, network shares, installed software, and security configurations prior to lateral movement.