LOLBAS Fundamentals

What Is Living Off the Land?

The phrase "Living Off the Land" entered security research around 2013. Early APT reports began documenting a consistent pattern: advanced actors were completing intrusions without dropping a single custom binary. They used what was already there. The term stuck because it captures the behavior precisely. A farmer living off the land uses what the environment provides. An attacker doing the same uses what Windows already installed.

The core principle is availability. Every Windows workstation ships with certutil.exe, mshta.exe, regsvr32.exe, rundll32.exe, and dozens of other capable utilities. These binaries are signed by Microsoft, trusted by every security product, and present in every environment. An attacker who uses certutil.exe to download a payload has introduced no new binary. There is no hash to block, no suspicious file to detect, and no unusual entry in the process list. The only thing that changed is how a legitimate tool was called.

Modern EDRs and AV products have strong detection coverage for known malware families. That coverage depends on recognizing something unusual: a file with a malicious hash, a known exploit signature, or a process with no legitimate business context. LOL techniques sidestep all three. The binary is legitimate. The hash matches the Microsoft-signed original. The process has been running on every Windows machine for twenty years.

Attackers use LOLBins to accomplish three things. Execution: running arbitrary code without dropping a foreign binary. Download: fetching remote payloads through trusted Windows utilities that proxy network requests. Persistence: maintaining access after reboots by embedding persistence in scheduled tasks, COM registrations, or BITS transfer jobs, all managed via built-in tools.

The LOLBAS Project

The LOLBAS Project (lolbas-project.github.io) is the community-maintained reference catalog for Windows binaries, scripts, and libraries that can be abused for living-off-the-land attacks. Security researchers contribute entries, and the project is maintained on GitHub. It is the first place to check when building detection coverage for LOL techniques.

Each catalog entry follows a consistent structure. It names the binary and describes its legitimate Windows function first. Then it documents the abuse commands with working examples, the required permissions, which Windows versions are affected, and the ATT&CK technique ID that maps to the abuse pattern. Many entries include references to known threat actor usage and detection hints.

The catalog covers four categories. LOLBins are signed Windows executables. LOLScripts are scripting engines and the script formats they run. LOLLibs are .NET assemblies and COM components that can be loaded by legitimate processes. LOLDrivers are signed kernel drivers with known vulnerabilities, used for BYOVD attacks. As of 2026 the catalog contains 150+ entries, and researchers continue adding new discoveries.

For defenders, the LOLBAS Project functions as a hypothesis generator. Every entry is a potential hunt. The question for each one is: "Has this binary been used in my environment in a way that matches the documented abuse pattern?" Working through the catalog systematically, prioritized by technique prevalence and environment relevance, is a practical hunt program structure.

LOLBin, LOLScript, LOLLib, LOLDriver

The four categories are distinct in how they operate, what they require, and how difficult they are to detect. Understanding the differences matters for prioritizing detection coverage.

LOLBins (Living Off the Land Binaries) are signed Windows executables used for execution proxy, download, or persistence. The list includes certutil.exe for download cradles and Base64 operations, mshta.exe for loading remote HTA files, regsvr32.exe for COM scriptlet execution (the Squiblydoo technique), rundll32.exe for arbitrary DLL loading, wscript.exe and cscript.exe for VBScript and JScript execution, bitsadmin.exe for BITS-based downloads, wmic.exe for remote process creation, and installutil.exe for executing code embedded in .NET assemblies. The common thread: each binary has a legitimate function that gives it trust, and each has a documented abuse pattern that exploits that trust.

LOLScripts (Living Off the Land Scripts) are the scripting engines and script file formats used to run attacker-controlled code. PowerShell is the most widely abused, with documented techniques ranging from simple encoded commands to obfuscated multi-stage loaders. VBScript (.vbs) and JScript (.js) files run through Windows Script Host are common phishing delivery mechanisms. WSH files (.wsf) can combine multiple scripting languages in a single file. The distinguishing characteristic of LOLScript abuse is that the script interpreter itself is trusted. The interpreter has not changed. The script it runs has.

LOLLibs (Living Off the Land Libraries) are .NET assemblies and COM components loaded by legitimate processes to execute attacker code. This category is less commonly discussed but increasingly exploited. Attackers load malicious .NET assemblies via installutil.exe or regasm.exe, which are themselves LOLBins. COM components registered in the user hive (HKCU) can be loaded by trusted processes to execute arbitrary code. The detection challenge is that the loading process is legitimate, and the library being loaded may not touch disk at all.

LOLDrivers (Living Off the Land Drivers) are legitimate but vulnerable signed kernel drivers loaded via BYOVD (Bring Your Own Vulnerable Driver). The technique loads a vulnerable driver with a known exploit to achieve kernel-level code execution. Notable examples include mhyprot2.sys, a driver from the game Genshin Impact that several ransomware groups weaponized to terminate EDR processes, and RTCore64.sys from an MSI utility. The driver is legitimately signed, passes code signing validation, and operates at ring 0.

ATT&CK Mapping for LOL Techniques

MITRE ATT&CK organizes LOLBin abuse primarily under T1218, Signed Binary Proxy Execution. The parent technique covers the general concept of using a signed Windows binary as a proxy to execute code, bypassing defenses that trust signed executables. T1218 currently has 14 named subtechniques, each covering a specific binary or technique family.

Several related techniques fall outside T1218 but are closely associated with LOL tradecraft. T1059 (Command and Scripting Interpreter) covers PowerShell (T1059.001), VBScript (T1059.005), and JavaScript/JScript (T1059.007). T1197 (BITS Jobs) covers bitsadmin-based downloads and persistence. T1105 (Ingress Tool Transfer) covers download cradles including certutil. T1140 (Deobfuscate/Decode Files) covers certutil -decode operations.

Most LOL techniques fall under the Defense Evasion tactic in the ATT&CK matrix. The mechanism is consistent: a technique evades defenses by executing inside the context of a trusted, signed Windows binary. The adversary is not evading detection by being stealthy. They are evading it by being indistinguishable from a legitimate process on first inspection.

The Pyramid of Pain is relevant here. Individual command line arguments sit at the TTP level, which is the hardest layer for an adversary to change. An actor can rotate IP addresses in minutes. They cannot stop using certutil for downloads without rewriting their toolkit. Detections anchored at the TTP level are more durable than those anchored at hashes or IPs.

Why Traditional Defenses Struggle

Hash-based detection fails completely against LOLBin abuse. The binary in question is always certutil.exe, signed by Microsoft, with a known-good hash that appears in every threat intelligence feed as benign. Hash lookups are the foundation of most AV and EDR allow/deny decisions, and for LOLBins that foundation is structurally irrelevant. There is nothing malicious in the file to detect.

Signature-based behavioral rules struggle with false positive rates. Certutil.exe runs constantly in enterprise environments for certificate operations: verifying OCSP, managing local certificate stores, parsing CRL files. A rule that fires on any certutil execution would generate thousands of alerts per day in a medium-sized organization. Analysts who investigate those alerts, find nothing, and investigate again tomorrow, eventually stop investigating. The rule gets tuned down or disabled.

Application allowlisting fails unless it incorporates command line context. Regsvr32.exe is on every allowlist because Windows requires it for COM registration. Blocking regsvr32 breaks operating system functionality. The allowlist entry cannot simply be removed. What it needs is refinement: allow regsvr32 for standard system32 COM paths and DLLs, alert on regsvr32 with a URL in the command line. That distinction requires command line analysis that basic allowlisting does not provide.

Alert fatigue amplifies every other problem. When LOLBin detections are broad and noisy, analysts face a choice between investigating every alert (unsustainable) or tuning the alert volume down (creates gaps). Attackers are aware of this dynamic. A commonly cited attacker tactic is to intentionally trigger noisy but benign-looking LOLBin activity first, saturating the alert queue before the actual malicious phase begins.

The structural solution is behavioral context. A certutil alert that fires only when certutil makes an outbound HTTP request, was not spawned by a WSUS relay or a certificate auto-enrollment service, and is running on a standard user workstation has a fundamentally different false positive profile than a rule on certutil alone. That combination of binary, parent process, command line flags, and network behavior is the indicator. None of those elements is individually sufficient.

What This Module Covers

Eight chapters build from fundamentals to advanced evasion, with a total time investment of roughly 10 hours. Each chapter stands alone, but the sequence is deliberate: concepts introduced early reappear in the detection and tradecraft chapters later.

Chapter 1 (this chapter) establishes the vocabulary, the threat model, and the detection problem. Chapter 2 covers the LOLBin Catalog in depth: the 12 most abused binaries, their documented commands, their ATT&CK IDs, and the single highest-signal detection pattern for each. Chapter 3 covers LOLScripts, LOLLibs, and LOLDrivers: PowerShell abuse techniques, .NET assembly exploitation, and BYOVD mechanics.

Chapter 4 moves into attacker tradecraft: how threat actors chain multiple LOLBins to build complete attack chains from initial access through persistence and lateral movement without ever dropping a foreign binary. Chapter 5 covers detection strategy: behavioral detection architecture, parent-child process analysis, command line baselining, and building detections that survive production environments. Chapter 6 provides the query syntax: KQL, SPL, and Sigma detection queries for every major LOLBin covered in the module.

Chapter 7 grounds the techniques in real-world campaigns. APT29 (Cozy Bear), FIN7, and several ransomware groups have documented LOLBin usage. Understanding how specific actors use these techniques informs detection prioritization. Chapter 8 covers the advanced tier: AMSI bypass techniques, script block logging evasion, AppLocker bypass chains, BYOVD in detail, and the hardening controls that raise the cost of LOL attacks.

The full module is approximately 10 hours of content across 8 chapters, with knowledge checks and detection query exercises throughout. The skill range moves from beginner (Chapters 1 and 2) through intermediate (Chapters 3 through 6) to advanced (Chapters 7 and 8). Working through the module sequentially provides the most complete picture, but individual chapters are self-contained enough to be used as references.