LOLBAS-Project/LOLBAS

Features

• Signed Binary Proxying - Provides a comprehensive database of signed binaries used to bypass execution restrictions by spawning unauthorized processes.
• Binary Security References - Provides a structured collection of signed binaries mapped to their functional capabilities and security evasion potential.
• Living Off The Land Binaries - Provides a curated collection of signed Windows binaries usable for security bypass and attack execution.
• Administrative Living-Off-The-Land Techniques - Identifies and uses signed system binaries to execute unauthorized code or bypass security restrictions.
• Evasion Detection Rules - Provides detection rules to identify when signed binaries are used for security evasion.
• Credential Dumping - Extracts authentication material from the Local Security Authority Subsystem Service (LSASS) memory dump.
• Defense Evasion - Uses trusted binaries and alternate data streams to hide payloads and evade defensive monitoring.
• Evasion and Bypass Tools - Provides techniques to run unsigned scripts or binaries by proxying execution through trusted signed system files.
• Adversary Technique Mappings - Links specific system binaries to known attack patterns and tactical objectives.
• Alternate Data Stream Persistence - Ensures persistence by hiding binary payloads within filesystem alternate data streams.
• Registry Persistence - Achieves persistence by running pre-configured tasks stored within Windows registry keys.
• Security Research Repositories - Serves as a technical knowledge base for identifying exploitation patterns and creating detection rules.
• DLL Injection Hooks - Inserts dynamic link libraries into running processes to execute code under their context.
• Remote Injection - Documents binaries that allow injecting custom DLLs into services to execute arbitrary code.
• Unsigned DLL Loading - Identifies methods to load unsigned DLLs using signed binaries as triggers.
• Bypass Execution - Identifies signed tools that can be used to launch renamed binaries as child processes to evade security controls.
• Trusted Identity Shell Spawning - Lists binaries that spawn command shells under a trusted identity to execute unauthorized commands.
• Indirect Process Execution - Runs specified processes using a signed binary as the parent to evade defensive monitoring.
• Binary Capability Catalogs - Catalogs system executables mapped to their ability to execute code, download files, or exfiltrate data.
• Capability Classifications - Implements a classification system that categorizes binaries by their ability to perform tasks like file transfer or code execution.
• DLL Proxy Execution - Maps signed system binaries that can be used as proxies to load and run DLL files.
• Hosting - Identifies signed binaries that can host PowerShell scripts to bypass security defenses.
• Unsigned - Documents signed binaries that allow the local execution of unsigned C# code.
• Multi-Language Script Execution - Provides a database of binaries that execute JavaScript, JScript, and VBScript from local or remote sources.
• Detection Signature Development - Provides detection signatures to recognize when binaries are used for memory dumps or unsigned code execution.
• Exploitable Binary Catalogs - Catalogues signed binaries and libraries that can be misused to execute code or download payloads.
• Credential Extraction Utilities - Dumps registry hives to extract password hashes and sensitive security material from the system.
• In-Memory Payload Execution - Catalogues the use of signed binaries to execute libraries and scripts in memory to avoid detection.
• Serialized Payload Execution - Documents the use of signed binaries to execute malicious serialized payloads.
• Proxy Execution - Launches executable files through trusted diagnostic tools to bypass security restrictions.
• Proxy Process Execution - Uses trusted signed binaries as proxy processes to execute other executables and evade detection.
• Remote Binary Execution - Catalogues binaries capable of downloading and executing compiled .NET binaries from remote servers.
• VBScript Remote Execution - Documents binaries that can execute VBScript code from remote servers or local configuration files.
• Signed Library Proxying - Identifies signed system libraries that can be used to launch DLLs or command-line instructions.
• Local Binary and Script Execution - Runs executable files or scripts on local or remote systems to bypass security controls.
• Suspicious Execution Indicators - Provides indicators of compromise and rules to spot abnormal usage of signed binaries.
• Threat Detection - Maps system binaries to attack techniques and creates signatures to identify malicious usage of trusted tools.
• Living Off The Land Tactics - Maps trusted operating system files to known offensive techniques used to evade defenses.
• Registry-Driven Command Execution - Runs COM objects defined in the registry to trigger code execution.
• Execution Redirection - Provides a registry of binaries that can be used to force the system to launch unauthorized payloads by modifying registry paths.
• Registry DLL Sideloading - Loads specified libraries by modifying system registry keys to proxy execution of external code.
• Script Execution - Runs logon or startup scripts defined in group policy to execute files on the system.
• File Transfer - Facilitates copying files from network sources to local destinations.
• Data Exfiltration - Exfiltrates files, credentials, and sensitive data from a local system to a remote destination.
• Database Export Utilities - Extracts data or binary payloads from SQL Server databases to the local filesystem.
• Binary Hiding - Embeds executable files within the alternate data stream of text files to evade security detection.
• File Hiding - Writes files to alternate data streams of target files to conceal them from detection.
• Hidden Code Execution - Runs scripts embedded within alternate data streams to conceal the source of execution.
• Registry Data Hiding - Exports and imports registry keys to files stored in alternate data streams to conceal data.
• Registry Stream Writing - Writes registry keys using data stored within an alternate data stream to evade detection.
• DLL Loading - Identifies signed binaries that load and execute specified DLLs from arbitrary paths.
• Argument Obfuscation - Hides command-line parameters from monitoring tools by using response files to pass options.
• Script Compilation - Documents the use of binaries to convert JScript source files into executable formats or DLLs.
• Source Compilation Tools - Identifies binaries that build and run source code from project files to execute logic on a target system.
• Configuration File Command Execution - Runs arbitrary commands by processing specially crafted configuration files.
• Information File Directives - The project launches executables or scriptlets by specifying files within an information file directive.
• File Copying Utilities - Moves source files to destination paths or alternate data streams using signed system binaries.
• Local Binary Execution - Runs executable files already present on the system by leveraging signed system binaries.
• Installation Payload Execution - Launches executable files or scriptlets by specifying directives within installation information files.
• Task Schedulers - Enables the creation of recurring or one-time tasks on local or remote systems to execute commands.
• OS Process Execution - Identifies signed binaries that can run a target process under their own context to evade detection.
• SSH-Based Remote Execution - Lists signed SSH clients that can be used to run commands or files on target machines.
• Network Traffic Analyzers - Includes capabilities for sniffing network packets and storing them in logs for traffic analysis.
• Remote File Downloads - Retrieves files from remote URLs and saves them to local storage via search operations.
• WebDAV Remote File Management - Retrieves files from remote WebDAV servers and saves them to the local filesystem.
• Process Memory Access - Extracts the memory of running processes using the MiniDump function to retrieve credentials.
• Security Driver Manipulation - Disables drivers used by security agents by leveraging signed system binaries.
• Locked Data Extraction - Enables extraction of locked files using volume shadow copy to bypass system restrictions.
• Protected Directory Access - Moves files into system-protected directories using signed binaries to conceal payloads.
• System File Replacement - Swaps target system files with alternative versions to modify system behavior.
• Volume Shadow Copy Abuse - Abuses the volume shadow copy service to dump sensitive data and access protected system files.
• DLL Proxy Execution - Documents the use of signed binaries to load and run .NET library files to bypass whitelisting.
• C# Project Execution - Runs C# projects from a local directory using a signed execution environment.
• C# Compilers - Identifies trusted system binaries that can compile C# source files into executables.
• Visual Basic Compilation - Identifies binaries capable of transforming Visual Basic source code into executable binaries.
• Authentication Hash Capture - Triggers authenticated connections to force the leakage or relaying of NTLM authentication hashes.
• Batch Script Execution - Provides capabilities to launch batch files to run commands and bypass application whitelisting.
• Data Exfiltration Tools - Uploads files or credentials to external data feeds using signed command-line tools.
• Deployment Proxy Execution - Lists signed deployment binaries that can be leveraged with registry configurations to run arbitrary commands.
• Directory Database Permission Manipulations - Extracts sensitive directory information by manipulating permissions to facilitate volume shadow copy extraction of the NTDS.dit database.
• PowerShell Policy Bypasses - Runs PowerShell scripts by bypassing execution policies through trusted system processes.
• HTA Application Execution - Launches HTA applications via a signed system library to run code.
• Library-Based Application Launching - Launches specified executables by calling a library function to bypass standard execution restrictions.
• Managed Assembly Execution - Identifies signed binaries that load and run .NET assembly DLLs to execute arbitrary code.
• MSI Payload Execution - Downloads and installs remote MSI files to the local system to run arbitrary code.
• RegisterOCX Payload Execution - Launches DLLs or executables by calling the RegisterOCX function.
• Remote Host File Extraction - Extracts archived files from remote internal hosts to a local system for data exfiltration.
• COM Scriptlet Execution - Runs script code from local or remote XSL and XML files to execute commands.
• PowerShell Language Mode Bypasses - Runs scripts including those with non-standard extensions to bypass language mode constraints.
• Security Detection Logic - Includes a set of signature rules designed to identify abnormal execution patterns of trusted system binaries.
• Credential Management Tools - Manages cached usernames and passwords on a host by creating, listing, and deleting stored credentials.
• Shell Extension Exploitation - Lists binaries that invoke shell extension functions to launch HTML applications or executables.
• Store-Based Installation Bypasses - Downloads and installs software from digital stores by name or ID to bypass local security policies.
• UAC Bypasses - Executes binaries or scripts as high-integrity processes by manipulating registry values to bypass UAC.
• URL-Based Payload Execution - Provides methods to launch executable payloads by calling URL information files through system libraries.
• URL Proxy Execution - Lists signed system libraries that can be abused to launch executable payloads via URL files.
• WMI-Based Command Execution - Enables running arbitrary commands by creating process instances through the Windows Management Instrumentation interface.
• XAML Application Execution - Executes code within trusted environments by running browser-based XAML application files.
• Registry Path Configuration - Details how modifying the App Paths registry key can be used to proxy the execution of specified executables.
• Password Secret Scanning - Scans group policy files to identify stored passwords within specific attributes.
• Task Schedulers - Provides capabilities to schedule tasks at specific intervals to ensure persistent process execution.
• Window Hiding - Runs console applications in the background by setting the window handle to hidden.
• Spyware Screen Capturers - Stealthily records the user environment and clicks to gather reconnaissance data.

Star history