MITRE ATT&CK Techniques Abused by LOLBins

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be copied from an external adversary-controlled system over the command and control channel or through alternate protocols.

Adversaries may attempt to dump credentials to obtain account login and credential material, often in the form of password hashes or cleartext passwords.

Adversaries may use built-in utilities like certutil to decode files or information previously obfuscated or encrypted before execution.

Adversaries may abuse the Background Intelligent Transfer Service (BITS) to download, execute, or clean up malicious payloads in a covert manner.

Adversaries may leverage living-off-the-land techniques (T1202) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1216) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1216.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1216.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may bypass process and application-whitelisting mechanisms by proxying execution of malicious code with signed, trusted binaries.

Adversaries may leverage living-off-the-land techniques (T1218.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.003) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.004) to achieve execution, evade defenses, or transfer tools.

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and inline VBScript or JScript.

Adversaries may leverage living-off-the-land techniques (T1218.007) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.008) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.009) to achieve execution, evade defenses, or transfer tools.

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code via DLLs or scriptlets (Squiblydoo attack).

Adversaries may abuse rundll32.exe to proxy execution of malicious code through dynamic link libraries and script protocols.

Adversaries may leverage living-off-the-land techniques (T1218.012) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.013) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.014) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1218.015) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1219.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1220) to achieve execution, evade defenses, or transfer tools.

Adversaries may attempt to hide artifacts and malicious actions associated with behaviors to avoid detection by users and security tools.

Adversaries may attempt to get detailed information about the operating system and hardware, including version, patches, and architecture.

Adversaries may attempt to get a listing of local system or domain accounts to orient themselves within an environment.

Adversaries may abuse WMI or wmic.exe to execute malicious commands and query system information on local and remote systems.

Adversaries may abuse command and script interpreters to execute arbitrary commands, scripts, or binaries.

Adversaries may abuse the PowerShell commands and scripting environment for executing commands, downloading payloads, and automating post-exploitation actions.

Adversaries may abuse AppleScript commands or osascript to execute malicious code, harvest credentials via fake prompts, or interact with macOS services.

Adversaries may leverage living-off-the-land techniques (T1059.003) to achieve execution, evade defenses, or transfer tools.

Adversaries may abuse Unix shell interpreters (such as bash, sh, zsh) to execute arbitrary commands and run interactive reverse shells.

Adversaries may leverage living-off-the-land techniques (T1059.005) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1059.006) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1003.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1003.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1003.003) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1005) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1036) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1036.005) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1040) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1048) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1048.003) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1053.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1053.005) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1055) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1070) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1071) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1078) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1095) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1113) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1127) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1127.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1127.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1136.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1187) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1485) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1490) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1539) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1543.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1543.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1543.003) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1543.004) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1546.007) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1547) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1547.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1552.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1553.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1555.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1556) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1560.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1562) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1562.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1564.004) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1564.006) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1565.001) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1567) to achieve execution, evade defenses, or transfer tools.

Adversaries may leverage living-off-the-land techniques (T1573.002) to achieve execution, evade defenses, or transfer tools.

Adversaries may circumvent mechanisms designed to control elevation of privileges to gain higher-level permissions.

Adversaries may abuse SUID or SGID bits on binaries like find, bash, or python to escalate privileges to root.

Adversaries may bypass UAC mechanisms to elevate process privileges on Windows systems.