LOLBins & Execution Catalog

Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.

Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.

The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.

Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.

Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).

PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.

Windows Management Instrumentation Command-line (WMIC) provides a command-line interface for WMI. Abused for process execution, remote lateral movement, process creation, and running XSL stylesheets.

CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.

.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Tool used for installation of AppX/MSIX applications on Windows 10

Microsoft .NET ClickOnce Launch Utility.

ASP.NET Compilation Tool

Schedule periodic tasks

Helper binary for Assistive Technology (AT)

File used by Windows subsystem for Linux

Used for installing certificates

Used for requesting and managing certificates

Remote Desktop Services MultiUser Change Utility

File Encryption Utility

The command-line interpreter in Windows

creates, lists, and deletes stored user names and passwords or credentials.

Microsoft Connection Manager Auto-Download

Installs or removes a Connection Manager service profile.

Binary that handles color management