# LOLPulse
> The Unified Living-off-the-Land Binaries (LOLBins), Command Deobfuscation & Detection Engine.

- **Lead Researcher & Curator**: Sharon Ben Moshe (https://www.linkedin.com/in/sharon-ben-moshe/) — Cybersecurity researcher and Check Point malware analyst.
- **Published Research**:
  - [OpwnAI: AI That Can Save the Day or HACK it Away](https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/) (Check Point Research, December 2022): Pioneering threat research analyzing ChatGPT and Large Language Model (LLM) weaponization across the cyber kill chain—from automated spear-phishing and malicious macro generation to polymorphic code execution—alongside defensive AI applications.
  - [The Weaponization of PDFs: 68% of Cyber attacks begin in your inbox, with 22% of these hiding in PDFs](https://blog.checkpoint.com/research/the-weaponization-of-pdfs-68-of-cyberattacks-begin-in-your-inbox-with-22-of-these-hiding-in-pdfs/) (Check Point Research, April 2025): Deep-dive malware analysis dissecting malicious PDF abuse vectors, embedded JavaScript execution, font obfuscation, and evasive delivery mechanisms targeting corporate inboxes.
- **Platform URL**: https://www.lolpulse.dev
- **Telemetry Sources**: Windows Security (Event 4688), Sysmon (1, 3, 7, 8, 11), PowerShell ScriptBlock (4104), Linux auditd (EXECVE), macOS Endpoint Security.
- **Rule Output Formats**: Microsoft Sentinel / Defender KQL, Sigma v2 YAML standard, Splunk SPL.

## Key Interfaces
- [Command Line Analyzer](https://www.lolpulse.dev/analyzer): Client-side command line decoder, deobfuscator, and instant detection query builder.
- [Catalog Directory](https://www.lolpulse.dev/directory): Unified catalog of 303 living-off-the-land binaries.
- [Research Methodology & Author Profile](https://www.lolpulse.dev/about): Author bio for Sharon Ben Moshe, testing methodology, and lab verification standards.

## Attack Categories & Objectives
- [Download LOLBins](https://www.lolpulse.dev/categories/download): Download LOLBins & Ingress Tool Transfer Utilities
- [Execute LOLBins](https://www.lolpulse.dev/categories/execute): Execution LOLBins & Script Interpreter Abuse
- [UAC Bypass LOLBins](https://www.lolpulse.dev/categories/uac-bypass): UAC Bypass LOLBins & Privilege Escalation Vectors
- [Defense Evasion LOLBins](https://www.lolpulse.dev/categories/defense-evasion): Defense Evasion LOLBins: AppLocker & Antivirus Bypasses
- [Credential Dump LOLBins](https://www.lolpulse.dev/categories/credential-dump): Credential Dumping LOLBins & Memory Extraction Tools
- [Persistence LOLBins](https://www.lolpulse.dev/categories/persistence): Persistence LOLBins & Scheduled Execution Mechanisms
- [Reconnaissance LOLBins](https://www.lolpulse.dev/categories/reconnaissance): Reconnaissance LOLBins & Internal Host Discovery

## High-Profile Living-off-the-Land Binaries
- [certutil.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/certutil): Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.
- [mshta.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/mshta): Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.
- [rundll32.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/rundll32): The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.
- [bitsadmin.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/bitsadmin): Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.
- [regsvr32.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/regsvr32): Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).
- [powershell.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/powershell): PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.
- [wmic.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/wmic): Windows Management Instrumentation Command-line (WMIC) provides a command-line interface for WMI. Abused for process execution, remote lateral movement, process creation, and running XSL stylesheets.
- [cscript.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cscript): CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.
- [AddinUtil.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/addinutil-exe): .NET Tool used for updating cache files for Microsoft Office Add-Ins.
- [AppInstaller.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/appinstaller-exe): Tool used for installation of AppX/MSIX applications on Windows 10
- [Applaunch.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/applaunch-exe): Microsoft .NET ClickOnce Launch Utility.
- [Aspnet_Compiler.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/aspnet-compiler-exe): ASP.NET Compilation Tool
- [At.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/at-exe): Schedule periodic tasks
- [Atbroker.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/atbroker-exe): Helper binary for Assistive Technology (AT)
- [Bash.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/bash-exe): File used by Windows subsystem for Linux
- [CertOC.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/certoc-exe): Used for installing certificates
- [CertReq.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/certreq-exe): Used for requesting and managing certificates
- [Change.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/change-exe): Remote Desktop Services MultiUser Change Utility
- [Cipher.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cipher-exe): File Encryption Utility
- [Cmd.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cmd-exe): The command-line interpreter in Windows
- [Cmdkey.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cmdkey-exe): creates, lists, and deletes stored user names and passwords or credentials.
- [cmdl32.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cmdl32-exe): Microsoft Connection Manager Auto-Download
- [Cmstp.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/cmstp-exe): Installs or removes a Connection Manager service profile.
- [Colorcpl.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/colorcpl-exe): Binary that handles color management
- [ComputerDefaults.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/computerdefaults-exe): ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.
- [ConfigSecurityPolicy.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/configsecuritypolicy-exe): Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
- [Conhost.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/conhost-exe): Console Window host
- [Control.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/control-exe): Binary used to launch controlpanel items in Windows
- [Csc.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/csc-exe): Binary file used by .NET Framework to compile C# code
- [CustomShellHost.exe (WINDOWS)](https://www.lolpulse.dev/lolbins/windows/customshellhost-exe): A host process that is used by custom shells when using Windows in Kiosk mode.

## Full Catalog Access
- [Full LLM Dump](https://www.lolpulse.dev/llms-full.txt): Complete structured text dump of all 303 LOLBins with default paths and weaponized commands.