0xHabib

LOLBAS Categories

Interactive reference of Living Off the Land Binaries and Scripts categories. Browse built-in Windows tools abused for execution, persistence, lateral movement, and defense evasion, organized by ATT&CK tactic.

By Mohamed Habib Jaouadi•December 1, 2025•
Post Related
#lolbas
#living-off-the-land
#defense-evasion
#windows
#red-team
#threat-hunting
LOLBAS Intelligence (2026 Reality)
Current viability and status of common binaries and techniques

Native Windows Utilities

T1218
powershell.exe
Legacy

Scripting engine with .NET Framework access (T1059.001)

Noisy
wmic.exe
Modern

Windows Management Instrumentation CLI (T1047)

High-Signal
certutil.exe
Legacy

Certificate utility with download capabilities (T1105)

High-Signal
bitsadmin.exe
Unreliable

Background Intelligent Transfer Service admin (T1197)

Moderate
regsvr32.exe
Legacy

DLL registration and execution utility (T1218.010)

Noisy
rundll32.exe
Modern

DLL function launcher (T1218.011)

High-Signal

Administration Tools

T1021
psexec.exe
Modern

Sysinternals remote execution tool (T1569.002)

High-Signal
winrm
Modern

PowerShell remoting framework (T1021.006)

High-Signal
schtasks.exe
Modern

Scheduled task manager (T1053.005)

High-Signal
sc.exe
Modern

Service control manager (T1569.002)

High-Signal
net.exe
Modern

Network administration utility (T1070)

High-Signal

Development Tools

T1127
msbuild.exe
Modern

Microsoft Build Engine (.NET compiler) (T1127.001)

High-Signal
csc.exe
Modern

C# compiler

High-Signal
installutil.exe
Legacy

.NET installer utility (T1218.004)

Noisy
regasm.exe
Legacy

.NET assembly registration (T1218.009)

Noisy

Execution & Persistence Abuse

T1546
COM Hijacking
Modern

Abusing per-user registration and elevated CLSIDs (T1546.015)

Stealth
DLL Side-Loading
Modern

Leveraging signed OS binaries to load custom DLLs (T1574.002)

Stealth
mshta.exe
Unreliable

HTML Application host (T1218.005)

Noisy

Detection Challenge

Legitimate tools with Microsoft signatures are difficult to detect via signatures. Behavioral analysis and baseline deviation are critical.