LOLBAS (Living Off the Land Binaries and Scripts (in Windows))
LOLBAS

            
            
                AddinUtil.exe
                Execute

                Binaries
                T1218

            
            
            
                AppInstaller.exe
                Download (INetCache)

                Binaries
                T1105

            
            
            
                Aspnet_Compiler.exe
                AWL bypass

                Binaries
                T1127

            
            
            
                At.exe
                Execute

                Binaries
                T1053.002

            
            
            
                Atbroker.exe
                Execute

                Binaries
                T1218

            
            
            
                Bash.exe
                ExecuteAWL bypass

                Binaries
                T1202

            
            
            
                Bitsadmin.exe
                Alternate data streamsDownloadCopyExecute

                Binaries
                T1564.004T1105T1218

            
            
            
                CertOC.exe
                Execute (DLL)Download

                Binaries
                T1218T1105

            
            
            
                CertReq.exe
                DownloadUpload

                Binaries
                T1105

            
            
            
                Certutil.exe
                DownloadAlternate data streamsEncodeDecode

                Binaries
                T1105T1564.004T1027.013T1140

            
            
            
                Cmd.exe
                Alternate data streamsDownloadUpload

                Binaries
                T1564.004T1059.003T1105T1048.003

            
            
            
                Cmdkey.exe
                Credentials

                Binaries
                T1078

            
            
            
                cmdl32.exe
                Download

                Binaries
                T1105

            
            
            
                Cmstp.exe
                Execute (INF)AWL bypass (INF)

                Binaries
                T1218.003

            
            
            
                Colorcpl.exe
                Copy

                Binaries
                T1036.005

            
            
            
                ComputerDefaults.exe
                UAC bypass

                Binaries
                T1548.002

            
            
            
                ConfigSecurityPolicy.exe
                UploadDownload (INetCache)

                Binaries
                T1567T1105

            
            
            
                Conhost.exe
                Execute

                Binaries
                T1202

            
            
            
                Control.exe
                Alternate data streams (DLL)

                Binaries
                T1218.002

            
            
            
                Csc.exe
                Compile

                Binaries
                T1127

            
            
            
                Cscript.exe
                Alternate data streams (WSH)

                Binaries
                T1564.004

            
            
            
                CustomShellHost.exe
                Execute

                Binaries
                T1218

            
            
            
                DataSvcUtil.exe
                Upload

                Binaries
                T1567

            
            
            
                Desktopimgdownldr.exe
                Download

                Binaries
                T1105

            
            
            
                DeviceCredentialDeployment.exe
                Conceal

                Binaries
                T1564

            
            
            
                Dfsvc.exe
                AWL bypass

                Binaries
                T1127

            
            
            
                Diantz.exe
                Alternate data streams (Compression)Download (Compression)Execute (Compression)

                Binaries
                T1564.004T1105T1036

            
            
            
                Diskshadow.exe
                DumpExecute

                Binaries
                T1003.003T1202

            
            
            
                Dnscmd.exe
                Execute (DLL)

                Binaries
                T1543.003

            
            
            
                Esentutl.exe
                CopyAlternate data streamsDownload

                Binaries
                T1105T1564.004T1003.003

            
            
            
                Eventvwr.exe
                UAC bypass (GUI)

                Binaries
                T1548.002

            
            
            
                Expand.exe
                DownloadCopyAlternate data streams

                Binaries
                T1105T1564.004

            
            
            
                Explorer.exe
                Execute

                Binaries
                T1202

            
            
            
                Extexport.exe
                Execute (DLL)

                Binaries
                T1218

            
            
            
                Extrac32.exe
                Alternate data streams (Compression)DownloadCopy

                Binaries
                T1564.004T1105

            
            
            
                Findstr.exe
                Alternate data streamsCredentialsDownload

                Binaries
                T1564.004T1552.001T1105

            
            
            
                Finger.exe
                Download

                Binaries
                T1105

            
            
            
                fltMC.exe
                Tamper

                Binaries
                T1562.001

            
            
            
                Forfiles.exe
                ExecuteAlternate data streams

                Binaries
                T1202T1564.004

            
            
            
                Fsutil.exe
                TamperExecute

                Binaries
                T1485T1218

            
            
            
                Ftp.exe
                ExecuteDownload

                Binaries
                T1202T1105

            
            
            
                Gpscript.exe
                Execute

                Binaries
                T1218

            
            
            
                Hh.exe
                DownloadExecute

                Binaries
                T1105T1218.001

            
            
            
                IMEWDBLD.exe
                Download (INetCache)

                Binaries
                T1105

            
            
            
                Ie4uinit.exe
                Execute

                Binaries
                T1218

            
            
            
                iediagcmd.exe
                Execute

                Binaries
                T1218

            
            
            
                Ieexec.exe
                DownloadExecute

                Binaries
                T1105T1218

            
            
            
                Ilasm.exe
                Compile

                Binaries
                T1127

            
            
            
                Infdefaultinstall.exe
                Execute

                Binaries
                T1218

            
            
            
                Installutil.exe
                AWL bypass (DLL, Custom Format)Execute (DLL, Custom Format)Download (INetCache)

                Binaries
                T1218.004T1105

            
            
            
                Jsc.exe
                Compile (WSH)

                Binaries
                T1127

            
            
            
                Ldifde.exe
                Download

                Binaries
                T1105

            
            
            
                Makecab.exe
                Alternate data streams (Compression)Download (Compression)Execute (Compression)

                Binaries
                T1564.004T1105T1036

            
            
            
                Mavinject.exe
                Execute (DLL)Alternate data streams (DLL)

                Binaries
                T1218.013T1564.004

            
            
            
                Microsoft.Workflow.Compiler.exe
                ExecuteAWL bypass

                Binaries
                T1127

            
            
            
                Mmc.exe
                ExecuteUAC bypass

                Binaries
                T1218.014

            
            
            
                MpCmdRun.exe
                DownloadAlternate data streams

                Binaries
                T1105T1564.004

            
            
            
                Msbuild.exe
                AWL bypassExecute (DLL, WSH)

                Binaries
                T1127.001T1036

            
            
            
                Msconfig.exe
                Execute

                Binaries
                T1218

            
            
            
                Msdt.exe
                Execute (GUI)AWL bypass (GUI)

                Binaries
                T1218T1202

            
            
            
                Msedge.exe
                DownloadExecute

                Binaries
                T1105T1218.015

            
            
            
                Mshta.exe
                Execute (WSH)Alternate data streams (WSH)Download (INetCache)

                Binaries
                T1218.005T1105

            
            
            
                Msiexec.exe
                Execute (DLL)

                Binaries
                T1218.007

            
            
            
                Netsh.exe
                Execute (DLL)

                Binaries
                T1546.007

            
            
            
                Ngen.exe
                Download (INetCache)

                Binaries
                T1105

            
            
            
                Odbcconf.exe
                Execute (DLL)

                Binaries
                T1218.008

            
            
            
                OfflineScannerShell.exe
                Execute (DLL)

                Binaries
                T1218

            
            
            
                OneDriveStandaloneUpdater.exe
                Download

                Binaries
                T1105

            
            
            
                Pcalua.exe
                Execute (DLL)

                Binaries
                T1202

            
            
            
                Pcwrun.exe
                Execute

                Binaries
                T1218T1202

            
            
            
                Pktmon.exe
                Reconnaissance

                Binaries
                T1040

            
            
            
                Pnputil.exe
                Execute

                Binaries
                T1547

            
            
            
                Presentationhost.exe
                ExecuteDownload (INetCache)

                Binaries
                T1218T1105

            
            
            
                Print.exe
                Alternate data streamsCopy

                Binaries
                T1564.004T1105

            
            
            
                PrintBrm.exe
                Download (Compression)Alternate data streams (Compression)

                Binaries
                T1105T1564.004

            
            
            
                Provlaunch.exe
                Execute

                Binaries
                T1218

            
            
            
                Psr.exe
                Reconnaissance

                Binaries
                T1113

            
            
            
                Rasautou.exe
                Execute (DLL)

                Binaries
                T1218

            
            
            
                rdrleakdiag.exe
                Dump

                Binaries
                T1003T1003.001

            
            
            
                Reg.exe
                Alternate data streamsCredentials

                Binaries
                T1564.004T1003.002

            
            
            
                Regasm.exe
                AWL bypass (DLL, Custom Format)Execute (DLL, Custom Format)

                Binaries
                T1218.009

            
            
            
                Regedit.exe
                Alternate data streams

                Binaries
                T1564.004

            
            
            
                Regini.exe
                Alternate data streams

                Binaries
                T1564.004

            
            
            
                Register-cimprovider.exe
                Execute (DLL)

                Binaries
                T1218

            
            
            
                Regsvcs.exe
                Execute (DLL, Custom Format)AWL bypass (DLL, Custom Format)

                Binaries
                T1218.009

            
            
            
                Regsvr32.exe
                AWL bypassExecute

                Binaries
                T1218.010

            
            
            
                Replace.exe
                CopyDownload

                Binaries
                T1105

            
            
            
                Rpcping.exe
                Credentials

                Binaries
                T1003T1187

            
            
            
                Rundll32.exe
                Execute (DLL)Alternate data streams (DLL)

                Binaries
                T1218.011T1564.004

            
            
            
                Runexehelper.exe
                Execute

                Binaries
                T1218

            
            
            
                Runonce.exe
                Execute

                Binaries
                T1218

            
            
            
                Runscripthelper.exe
                Execute

                Binaries
                T1218

            
            
            
                Sc.exe
                Alternate data streams

                Binaries
                T1564.004

            
            
            
                Schtasks.exe
                Execute

                Binaries
                T1053.005

            
            
            
                Scriptrunner.exe
                Execute

                Binaries
                T1202T1218

            
            
            
                Setres.exe
                Execute

                Binaries
                T1218

            
            
            
                SettingSyncHost.exe
                Execute

                Binaries
                T1218

            
            
            
                ssh.exe
                Execute

                Binaries
                T1202

            
            
            
                Stordiag.exe
                Execute

                Binaries
                T1218

            
            
            
                SyncAppvPublishingServer.exe
                Execute

                Binaries
                T1218

            
            
            
                Tar.exe
                Alternate data streams (Compression)Copy (Compression)

                Binaries
                T1564.004T1105

            
            
            
                Ttdinject.exe
                Execute

                Binaries
                T1127

            
            
            
                Tttracer.exe
                ExecuteDump

                Binaries
                T1127T1003

            
            
            
                Unregmp2.exe
                Execute

                Binaries
                T1202

            
            
            
                vbc.exe
                Compile (WSH)

                Binaries
                T1127

            
            
            
                Verclsid.exe
                Execute

                Binaries
                T1218.012

            
            
            
                Wab.exe
                Execute

                Binaries
                T1218

            
            
            
                wbadmin.exe
                Dump

                Binaries
                T1003.003

            
            
            
                winget.exe
                ExecuteDownload

                Binaries
                T1105

            
            
            
                Wlrmdr.exe
                Execute

                Binaries
                T1202

            
            
            
                Wmic.exe
                Alternate data streamsExecute (WSH)Copy

                Binaries
                T1564.004T1218T1105

            
            
            
                WorkFolders.exe
                Execute

                Binaries
                T1218

            
            
            
                Wscript.exe
                Alternate data streams (WSH)

                Binaries
                T1564.004

            
            
            
                Wsreset.exe
                UAC bypass

                Binaries
                T1548.002

            
            
            
                wuauclt.exe
                Execute (DLL)

                Binaries
                T1218

            
            
            
                Xwizard.exe
                ExecuteDownload (INetCache)

                Binaries
                T1218T1105

            
            
            
                msedge_proxy.exe
                DownloadExecute

                Binaries
                T1105T1218.015

            
            
            
                msedgewebview2.exe
                Execute

                Binaries
                T1218.015

            
            
            
                wt.exe
                Execute

                Binaries
                T1202

            
            
            
                Advpack.dll
                AWL bypass (INF)Execute (DLL)

                Libraries
                T1218.011

            
            
            
                Desk.cpl
                Execute

                Libraries
                T1218.011

            
            
            
                Dfshim.dll
                AWL bypass

                Libraries
                T1127

            
            
            
                Ieadvpack.dll
                AWL bypassExecute (DLL)

                Libraries
                T1218.011

            
            
            
                Ieframe.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Mshtml.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Pcwutl.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Scrobj.dll
                Download (INetCache)

                Libraries
                T1105

            
            
            
                Setupapi.dll
                AWL bypass (INF)Execute (INF)

                Libraries
                T1218.011

            
            
            
                Shdocvw.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Shell32.dll
                Execute (DLL)

                Libraries
                T1218.011

            
            
            
                Shimgvw.dll
                Download (INetCache)

                Libraries
                T1105

            
            
            
                Syssetup.dll
                AWL bypass (INF)Execute (INF)

                Libraries
                T1218.011

            
            
            
                Url.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Zipfldr.dll
                Execute

                Libraries
                T1218.011

            
            
            
                Comsvcs.dll
                Dump

                Libraries
                T1003.001

            
            
            
                AccCheckConsole.exe
                Execute (DLL)AWL bypass (DLL)

                OtherMSBinaries
                T1218

            
            
            
                adplus.exe
                DumpExecute

                OtherMSBinaries
                T1003.001T1127

            
            
            
                AgentExecutor.exe
                Execute

                OtherMSBinaries
                T1218

            
            
            
                AppCert.exe
                Execute

                OtherMSBinaries
                T1127T1218.007

            
            
            
                Appvlp.exe
                Execute

                OtherMSBinaries
                T1218

            
            
            
                Bginfo.exe
                Execute (WSH)AWL bypass (WSH)

                OtherMSBinaries
                T1218

            
            
            
                Cdb.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                coregen.exe
                Execute (DLL)AWL bypass (DLL)

                OtherMSBinaries
                T1055T1218

            
            
            
                Createdump.exe
                Dump

                OtherMSBinaries
                T1003

            
            
            
                csi.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                DefaultPack.EXE
                Execute

                OtherMSBinaries
                T1218

            
            
            
                Devinit.exe
                Execute

                OtherMSBinaries
                T1218.007

            
            
            
                Devtoolslauncher.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                dnx.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                Dotnet.exe
                AWL bypassExecute

                OtherMSBinaries
                T1218T1059

            
            
            
                dsdbutil.exe
                Dump

                OtherMSBinaries
                T1003.003

            
            
            
                dtutil.exe
                Copy

                OtherMSBinaries
                T1105

            
            
            
                Dump64.exe
                Dump

                OtherMSBinaries
                T1003.001

            
            
            
                DumpMinitool.exe
                Dump

                OtherMSBinaries
                T1003.001

            
            
            
                Dxcap.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                Excel.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Fsi.exe
                AWL bypass

                OtherMSBinaries
                T1059

            
            
            
                FsiAnyCpu.exe
                AWL bypass

                OtherMSBinaries
                T1059

            
            
            
                Mftrace.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                Microsoft.NodejsTools.PressAnyKey.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                MSAccess.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Msdeploy.exe
                ExecuteAWL bypassCopy

                OtherMSBinaries
                T1218T1105

            
            
            
                MsoHtmEd.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Mspub.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                msxsl.exe
                ExecuteAWL bypassDownloadAlternate data streams

                OtherMSBinaries
                T1220T1105T1564

            
            
            
                ntdsutil.exe
                Dump

                OtherMSBinaries
                T1003.003

            
            
            
                OpenConsole.exe
                Execute

                OtherMSBinaries
                T1202

            
            
            
                Powerpnt.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Procdump.exe
                Execute (DLL)

                OtherMSBinaries
                T1202

            
            
            
                ProtocolHandler.exe
                Download

                OtherMSBinaries
                T1105

            
            
            
                rcsi.exe
                ExecuteAWL bypass

                OtherMSBinaries
                T1127

            
            
            
                Remote.exe
                AWL bypassExecute

                OtherMSBinaries
                T1127

            
            
            
                Sqldumper.exe
                Dump

                OtherMSBinaries
                T1003T1003.001

            
            
            
                Sqlps.exe
                Execute

                OtherMSBinaries
                T1218

            
            
            
                SQLToolsPS.exe
                Execute

                OtherMSBinaries
                T1218

            
            
            
                Squirrel.exe
                DownloadAWL bypassExecute

                OtherMSBinaries
                T1218

            
            
            
                te.exe
                Execute (DLL, Custom Format)

                OtherMSBinaries
                T1127

            
            
            
                Teams.exe
                Execute

                OtherMSBinaries
                T1218.015

            
            
            
                TestWindowRemoteAgent.exe
                Upload

                OtherMSBinaries
                T1048

            
            
            
                Tracker.exe
                Execute (DLL)AWL bypass (DLL)

                OtherMSBinaries
                T1127

            
            
            
                Update.exe
                DownloadAWL bypassExecute

                OtherMSBinaries
                T1218T1547T1070

            
            
            
                VSDiagnostics.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                VSIISExeLauncher.exe
                Execute

                OtherMSBinaries
                T1218

            
            
            
                Visio.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                VisualUiaVerifyNative.exe
                AWL bypass

                OtherMSBinaries
                T1218

            
            
            
                VSLaunchBrowser.exe
                Download (INetCache)Execute

                OtherMSBinaries
                T1105T1127

            
            
            
                Vshadow.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                vsjitdebugger.exe
                Execute

                OtherMSBinaries
                T1127

            
            
            
                Wfc.exe
                AWL bypass

                OtherMSBinaries
                T1127

            
            
            
                WinProj.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Winword.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                Wsl.exe
                ExecuteDownload

                OtherMSBinaries
                T1202T1105

            
            
            
                devtunnel.exe
                Download

                OtherMSBinaries
                T1105

            
            
            
                vsls-agent.exe
                Execute (DLL)

                OtherMSBinaries
                T1218

            
            
            
                vstest.console.exe
                AWL bypass (DLL)

                OtherMSBinaries
                T1127

            
            
            
                winfile.exe
                Execute

                OtherMSBinaries
                T1202

            
            
            
                xsd.exe
                Download (INetCache)

                OtherMSBinaries
                T1105

            
            
            
                CL_LoadAssembly.ps1
                Execute (DLL)

                Scripts
                T1216

            
            
            
                CL_Mutexverifiers.ps1
                Execute

                Scripts
                T1216

            
            
            
                CL_Invocation.ps1
                Execute

                Scripts
                T1216

            
            
            
                Launch-VsDevShell.ps1
                Execute

                Scripts
                T1216

            
            
            
                Manage-bde.wsf
                Execute

                Scripts
                T1216

            
            
            
                Pubprn.vbs
                Execute

                Scripts
                T1216.001

            
            
            
                Syncappvpublishingserver.vbs
                Execute

                Scripts
                T1216.002

            
            
            
                UtilityFunctions.ps1
                Execute (DLL)

                Scripts
                T1216

            
            
            
                winrm.vbs
                ExecuteAWL bypass

                Scripts
                T1216T1220

            
            
            
                Pester.bat
                Execute

                Scripts
                T1216

            
            
        