{
	"id": "836dbec2-46d7-4b8a-9a79-de0fa5da8b02",
	"created_at": "2026-04-06T00:21:40.281059Z",
	"updated_at": "2026-04-10T03:21:00.95324Z",
	"deleted_at": null,
	"sha1_hash": "e9b78ab6478aeeb79e2d8739ba65e001f642d180",
	"title": "GitHub - LOLBAS-Project/LOLBAS: Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 343180,
	"plain_text": "GitHub - LOLBAS-Project/LOLBAS: Living Off The Land\r\nBinaries And Scripts - (LOLBins and LOLScripts)\r\nBy wietze\r\nArchived: 2026-04-05 18:25:18 UTC\r\nbuild ppaassssiinngg\r\n \r\nLOLBAS 232\r\n Stars 8.4k\r\nLiving Off The Land Binaries and Scripts (and now also Libraries)\r\nhttps://github.com/LOLBAS-Project/LOLBAS\r\nPage 1 of 4\n\nAll the different files can be found behind a fancy frontend here: https://lolbas-project.github.io (thanks\r\n@ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/). This repo serves as a\r\nplace where we maintain the YML files that are used by the fancy frontend.\r\nGoal\r\nThe goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off\r\nThe Land techniques.\r\nCriteria\r\nA LOLBin/Lib/Script must:\r\nBe a Microsoft-signed file, either native to the OS or downloaded from Microsoft.\r\nHave extra \"unexpected\" functionality. It is not interesting to document intended use cases.\r\nExceptions are application whitelisting bypasses\r\nHave functionality that would be useful to an APT or red team\r\nInteresting functionality can include:\r\nExecuting code\r\nArbitrary code execution\r\nPass-through execution of other programs (unsigned) or scripts (via a LOLBin)\r\nCompiling code\r\nFile operations\r\nDownloading\r\nUpload\r\nCopy\r\nPersistence\r\nPass-through persistence utilizing existing LOLBin\r\nPersistence (e.g. hide data in ADS, execute at logon)\r\nUAC bypass\r\nCredential theft\r\nDumping process memory\r\nSurveillance (e.g. keylogger, network trace)\r\nLog evasion/modification\r\nDLL side-loading/hijacking without being relocated elsewhere in the filesystem.\r\nWe do not approve binaries that allows for netntlm coercing, since most Windows binaries allows for that. Only\r\nexception is binaries that allows that on other than default ports (such as rpcping) or can allow direct credential\r\ntheft.\r\nContributing\r\nhttps://github.com/LOLBAS-Project/LOLBAS\r\nPage 2 of 4\n\nIf you have found a new LOLBin or LOLScript that you would like to contribute, please review the contributing\r\nguidelines located here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/CONTRIBUTING.md\r\nA template for the required format has been provided here: https://github.com/LOLBAS-Project/LOLBAS/blob/master/YML-Template.yml\r\nThe History of the LOLBin\r\nThe phrase \"Living off the land\" was coined by Christopher Campbell (@obscuresec) \u0026 Matt Graeber\r\n(@mattifestation) at DerbyCon 3.\r\nThe term LOLBins came from a Twitter discussion on what to call binaries that can be used by an attacker to\r\nperform actions beyond their original purpose. Philip Goh (@MathCasualty) proposed LOLBins. A highly\r\nscientific internet poll ensued, and after a general consensus (69%) was reached, the name was made official.\r\nJimmy (@bohops) followed up with LOLScripts. No poll was taken.\r\nCommon hashtags for these files are:\r\n#LOLBin\r\n#LOLBins\r\n#LOLScript\r\n#LOLScripts\r\n#LOLLib\r\n#LOLLibs\r\nOur primary maintainer (@oddvarmoe) of this project did a talk at DerbyCon 2018 called: #Lolbins Nothing to\r\nLOL about! - https://www.youtube.com/watch?v=NiYTdmZ8GR4 This talk goes over the history of this project.\r\nMaintainers\r\nThe following folks help maintain the LOLBAS Project on their personal time:\r\nOddvar Moe (@oddvarmoe)\r\nJimmy Bayne (@bohops)\r\nConor Richard (@xenosCR)\r\nChris 'Lopi' Spehn (@ConsciousHacker)\r\nLiam (@liamsomerville)\r\nWietze (@Wietze)\r\nJose Hernandez (@_josehelps)\r\nThanks\r\nAs with many open-source projects, this one is the product of a community and we would like to thank ours:\r\nThe domain http://lolbins.com has been registered by an unknown individual and redirected it to the old\r\nversion of this project.\r\nhttps://github.com/LOLBAS-Project/LOLBAS\r\nPage 3 of 4\n\nThe domain http://lolbas-project.com has been registered by Jimmy (@bohops).\r\nThe logos for the project were created by Adam Nadrowski (@_sup_mane). We #@\u0026!!@#! love them.\r\nNotice\r\nPlease refer to NOTICE.md for license information\r\nSource: https://github.com/LOLBAS-Project/LOLBAS\r\nhttps://github.com/LOLBAS-Project/LOLBAS\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://github.com/LOLBAS-Project/LOLBAS"
	],
	"report_names": [
		"LOLBAS"
	],
	"threat_actors": [],
	"ts_created_at": 1775434900,
	"ts_updated_at": 1775791260,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e9b78ab6478aeeb79e2d8739ba65e001f642d180.pdf",
		"text": "https://archive.orkl.eu/e9b78ab6478aeeb79e2d8739ba65e001f642d180.txt",
		"img": "https://archive.orkl.eu/e9b78ab6478aeeb79e2d8739ba65e001f642d180.jpg"
	}
}