Meta tags:

Headings (most frequently used words):

lolbas, star, living, off, the, land, binaries, scripts, and, libraries,

Text of the page (most frequently used words):
exe (282), execute (156), #binaries (136), t1218 (90), othermsbinaries (79), dll (63), t1105 (59), download (57), cmd (55), bypass (41), t1127 (36), awl (34), remote (31), t1564 (26), alternate (26), data (26), streams (26), inetcache (24), t1202 (24), 004 (24), net (18), libraries (18), t1003 (17), 011 (13), 002 (12), 001 (12), dump (12), gui (12), scripts (11), copy (11), inf (11), compression (11), t1216 (10), 003 (9), csharp (8), powershell (7), uac (7), the (7), 015 (6), t1548 (6), xsl (5), ps1 (5), upload (5), wsh (5), rename (5), msi (5), change (5), att (5), nuget (4), t1059 (4), 007 (4), hta (4), url (4), registry (4), com (4), compile (4), credentials (4), t1036 (4), you (4), vbs (3), sct (3), xoml (3), netobjects (3), reconnaissance (3), fsharp (3), 005 (3), jscript (3), tamper (3), for (3), project (3), are (3), binary (2), t1220 (2), syncappvpublishingserver (2), t1547 (2), t1048 (2), t1040 (2), microsoft (2), clickonce (2), t1047 (2), t1053 (2), 009 (2), 013 (2), t1485 (2), t1562 (2), t1567 (2), more (2), out (2), our (2), this (2), can (2), looking (2), please (2), visit (2), mitre (2), and (2), lolbas (2), matches, pester, bat, winrm, utilityfunctions, pubprn, manage, bde, wsf, launch, vsdevshell, cl_invocation, cl_mutexverifiers, cl_loadassembly, xsd, winfile, vstest, console, vsls, agent, devtunnel, xbootmgrsleep, xbootmgr, wsl, 006, wsb, winword, winproj, windbg, wfc, framework, wfmformat, vsjitdebugger, vshadow, vslaunchbrowser, visualuiaverifynative, visio, vsiisexelauncher, vsdiagnostics, t1070, update, tracker, testwindowremoteagent, node, teams, custom, format, squirrel, sqltoolsps, sqlps, sqldumper, rcsi, protocolhandler, procdump, powerpnt, pixtool, outlook, openconsole, ntsd, ntdsutil, nmcap, msxsl, mspub, msohtmed, msdeploy, mscopilot_proxy, mscopilot, msaccess, mpiexec, nodejstools, pressanykey, mftrace, logger, intellitrace, fsianycpu, fsi, excel, ecmangen, dxcap, dumpminitool, dump64, dtutil, dsdbutil, dotnet, dnx, devtoolslauncher, devinit, defaultpack, csi, createdump, t1055, coregen, shellcode, cdb, bginfo, bcp, appvlp, appcert, applauncher, agentexecutor, adplus, acccheckconsole, comsvcs, zipfldr, syssetup, shimgvw, shell32, shdocvw, setupapi, scrobj, photoviewer, pcwutl, mshtml, ieframe, ieadvpack, dfshim, desk, cpl, advpack, write, setupugc, odbcad32, msedgewebview2, msedge_proxy, xwizard, wuauclt, wsreset, wscript, workfolders, t1518, discovery, antivirus, enumeration, wmic, wlrmdr, winget, wbemtest, wbadmin, wab, 012, verclsid, vbc, unregmp2, tttracer, ttdinject, tar, stordiag, ssh, sigverif, sftp, settingsynchost, setres, scriptrunner, scp, schtasks, runscripthelper, runonce, runexehelper, rundll32, t1187, rpcping, reset, replace, 010, regsvr32, regsvcs, register, cimprovider, regini, regedit, regasm, reg, rdrleakdiag, rasautou, query, t1113, psr, provlaunch, printbrm, print, xbap, presentationhost, pnputil, pktmon, pcwrun, pcalua, onedrivestandaloneupdater, offlinescannershell, 008, odbcconf, ngen, t1546, netsh, msoxmled, mst, msiexec, vbscript, mshta, msedge, msdt, msconfig, msbuild, mpcmdrun, mof, mofcomp, 014, mmc, workflow, compiler, mavinject, makecab, ldifde, jsc, iscsicpl, installutil, infdefaultinstall, ilasm, ieexec, iediagcmd, ie4uinit, imewdbld, chm, gpscript, ftp, fsutil, forfiles, fltmc, finger, t1552, findstr, extrac32, extexport, explorer, expand, eventvwr, eudcedit, esentutl, t1543, dnscmd, diskshadow, diantz, dfsvc, conceal, devicecredentialdeployment, desktopimgdownldr, datasvcutil, customshellhost, cscript, csc, control, conhost, configsecuritypolicy, computerdefaults, colorcpl, cmstp, cmdl32, t1078, cmdkey, cipher, t1140, t1027, decode, encode, certutil, certreq, certoc, bitsadmin, bash, atbroker, aspnet_compiler, appinstaller, addinutil, techniques, type, functions, info, click, logo, want, check, sets, what, define, lolbin, script, lib, information, programmatically, accesssing, found, see, current, mapping, unix, drivers, loldrivers, gtfobins, github, navigator, registered, trademarks, corporation, api, page, criteria, list, contribution, guide, contribute, living, off, land, star,

Text of the page (random words):
lolbas lolbas star living off the land binaries scripts and libraries for more info on the project click on the logo if you want to contribute check out our contribution guide our criteria list sets out what we define as a lolbin script lib more information on programmatically accesssing this project can be found on the api page mitre att ck and att ck are registered trademarks of the mitre corporation you can see the current att ck mapping of this project on the att ck navigator if you are looking for unix binaries please visit gtfobins github io if you are looking for drivers please visit loldrivers io binary functions type att ck techniques addinutil exe execute netobjects binaries t1218 appinstaller exe download inetcache binaries t1105 aspnet_compiler exe awl bypass binaries t1127 at exe execute cmd binaries t1053 002 atbroker exe execute exe binaries t1218 bash exe execute cmd awl bypass cmd binaries t1202 t1218 bitsadmin exe alternate data streams download copy execute binaries t1564 004 t1105 t1218 certoc exe execute dll download binaries t1218 t1105 certreq exe download upload binaries t1105 certutil exe download gui alternate data streams encode decode binaries t1105 t1564 004 t1027 013 t1140 change exe execute exe rename binaries t1218 cipher exe tamper binaries t1485 t1562 cmd exe alternate data streams download upload binaries t1564 004 t1059 003 t1105 t1048 003 cmdkey exe credentials binaries t1078 cmdl32 exe download binaries t1105 cmstp exe execute inf dll registry change awl bypass inf remote binaries t1218 003 colorcpl exe copy binaries t1036 005 computerdefaults exe uac bypass binaries t1548 002 configsecuritypolicy exe upload download inetcache binaries t1567 t1105 conhost exe execute cmd binaries t1202 control exe alternate data streams dll execute dll binaries t1218 002 csc exe compile binaries t1127 cscript exe alternate data streams wsh binaries t1564 004 customshellhost exe execute exe binaries t1218 datasvcutil exe upload binaries t1567 desktopimgdownldr exe download binaries t1105 devicecredentialdeployment exe conceal binaries t1564 dfsvc exe awl bypass clickonce remote binaries t1127 002 diantz exe alternate data streams compression download compression execute compression binaries t1564 004 t1105 t1036 diskshadow exe dump cmd execute cmd binaries t1003 003 t1202 dnscmd exe execute dll remote binaries t1543 003 esentutl exe copy alternate data streams download binaries t1105 t1564 004 t1003 003 eudcedit exe uac bypass cmd gui binaries t1548 002 eventvwr exe uac bypass gui exe netobjects binaries t1548 002 expand exe download copy alternate data streams binaries t1105 t1564 004 explorer exe execute exe binaries t1202 extexport exe execute dll binaries t1218 extrac32 exe alternate data streams compression download copy binaries t1564 004 t1105 findstr exe alternate data streams credentials download binaries t1564 004 t1552 001 t1105 finger exe download binaries t1105 fltmc exe tamper binaries t1562 001 forfiles exe execute exe alternate data streams exe binaries t1202 t1564 004 fsutil exe tamper execute exe binaries t1485 t1218 ftp exe execute cmd download binaries t1202 t1105 gpscript exe execute cmd binaries t1218 hh exe download exe gui execute exe gui cmd chm remote binaries t1105 t1218 001 imewdbld exe download inetcache binaries t1105 ie4uinit exe execute inf binaries t1218 iediagcmd exe execute exe binaries t1218 ieexec exe download remote exe net execute remote exe net binaries t1105 t1218 ilasm exe compile binaries t1127 infdefaultinstall exe execute inf binaries t1218 installutil exe awl bypass dll net exe net execute dll net exe net download inetcache binaries t1218 004 t1105 iscsicpl exe uac bypass dll cmd gui binaries t1548 002 jsc exe compile jscript binaries t1127 ldifde exe download binaries t1105 makecab exe alternate data streams compression download compression execute compression binaries t1564 004 t1105 t1036 mavinject exe execute dll alternate data streams dll binaries t1218 013 t1564 004 microsoft workflow compiler exe execute vb net csharp xoml awl bypass xoml binaries t1127 mmc exe execute com uac bypass dll download gui binaries t1218 014 mofcomp exe execute mof binaries t1047 mpcmdrun exe download alternate data streams binaries t1105 t1564 004 msbuild exe awl bypass csharp execute csharp dll xsl cmd binaries t1127 001 t1036 msconfig exe execute cmd binaries t1218 msdt exe execute gui msi awl bypass gui msi cmd binaries t1218 t1202 msedge exe download execute cmd binaries t1105 t1218 015 mshta exe execute hta remote vbscript jscript alternate data streams hta download inetcache binaries t1218 005 t1105 msiexec exe execute msi remote dll mst binaries t1218 007 msoxmled exe download inetcache binaries t1105 netsh exe execute dll binaries t1546 007 ngen exe download inetcache binaries t1105 odbcconf exe execute dll binaries t1218 008 offlinescannershell exe execute dll binaries t1218 onedrivestandaloneupdater exe download binaries t1105 pcalua exe execute exe dll remote binaries t1202 pcwrun exe execute exe binaries t1218 t1202 pktmon exe reconnaissance binaries t1040 pnputil exe execute inf binaries t1547 presentationhost exe execute xbap download inetcache binaries t1218 t1105 print exe alternate data streams copy binaries t1564 004 t1105 printbrm exe download compression alternate data streams compression binaries t1105 t1564 004 provlaunch exe execute cmd binaries t1218 psr exe reconnaissance binaries t1113 query exe execute exe rename binaries t1218 rasautou exe execute dll binaries t1218 rdrleakdiag exe dump binaries t1003 t1003 001 reg exe alternate data streams credentials binaries t1564 004 t1003 002 regasm exe awl bypass dll net execute dll net binaries t1218 009 regedit exe alternate data streams binaries t1564 004 regini exe alternate data streams binaries t1564 004 register cimprovider exe execute dll binaries t1218 regsvcs exe execute dll net awl bypass dll net binaries t1218 009 regsvr32 exe awl bypass sct remote execute sct remote dll binaries t1218 010 replace exe copy download binaries t1105 reset exe execute exe rename binaries t1218 rpcping exe credentials binaries t1003 t1187 rundll32 exe execute dll remote jscript com alternate data streams dll binaries t1218 011 t1564 004 runexehelper exe execute exe binaries t1218 runonce exe execute cmd binaries t1218 runscripthelper exe execute powershell binaries t1218 sc exe alternate data streams exe binaries t1564 004 schtasks exe execute cmd binaries t1053 005 scp exe execute cmd binaries t1202 scriptrunner exe execute exe remote cmd binaries t1202 t1218 setres exe execute exe binaries t1218 settingsynchost exe execute exe cmd binaries t1218 sftp exe execute cmd binaries t1202 sigverif exe execute exe gui binaries t1218 ssh exe execute cmd dll remote binaries t1202 stordiag exe execute exe binaries t1218 syncappvpublishingserver exe execute powershell binaries t1218 tar exe alternate data streams compression copy compression binaries t1564 004 t1105 ttdinject exe execute exe binaries t1127 tttracer exe execute exe dump binaries t1127 t1003 unregmp2 exe execute exe binaries t1202 vbc exe compile binaries t1127 verclsid exe execute com binaries t1218 012 wab exe execute dll binaries t1218 wbadmin exe dump binaries t1003 003 wbemtest exe execute gui cmd binaries t1047 winget exe execute remote exe download awl bypass binaries t1105 wlrmdr exe execute exe binaries t1202 wmic exe alternate data streams exe execute cmd remote xsl discovery antivirus enumeration copy binaries t1564 004 t1218 t1105 t1518 001 workfolders exe execute exe rename registry change binaries t1218 wscript exe alternate data streams wsh binaries t1564 004 wsreset exe uac bypass binaries t1548 002 wuauclt exe execute dll binaries t1218 xwizard exe execute com download inetcache binaries t1218 t1105 msedge_proxy exe download execute cmd binaries t1105 t1218 015 msedgewebview2 exe execute exe cmd binaries t1218 015 odbcad32 exe uac bypass cmd gui binaries t1548 002 setupugc exe execute cmd registry change binaries t1218 write exe execute exe registry change binaries t1218 wt exe execute cmd binaries t1202 advpack dll awl bypass inf execute dll exe cmd libraries t1218 011 desk cpl execute exe remote libraries t1218 011 dfshim dll awl bypass clickonce remote libraries t1127 002 ieadvpack dll awl bypass inf execute dll exe cmd libraries t1218 011 ieframe dll execute url libraries t1218 011 mshtml dll execute hta libraries t1218 011 pcwutl dll execute exe libraries t1218 011 photoviewer dll download inetcache libraries t1105 scrobj dll download inetcache libraries t1105 setupapi dll awl bypass inf execute inf libraries t1218 011 shdocvw dll execute url libraries t1218 011 shell32 dll execute dll exe cmd libraries t1218 011 shimgvw dll download inetcache libraries t1105 syssetup dll awl bypass inf execute inf libraries t1218 011 url dll execute hta url exe libraries t1218 011 zipfldr dll execute exe libraries t1218 011 comsvcs dll dump libraries t1003 001 acccheckconsole exe execute dll net awl bypass dll net othermsbinaries t1218 adplus exe dump execute cmd exe othermsbinaries t1003 001 t1127 agentexecutor exe execute powershell exe othermsbinaries t1218 applauncher exe execute exe othermsbinaries t1127 appcert exe execute exe msi othermsbinaries t1127 t1218 007 appvlp exe execute cmd exe othermsbinaries t1218 bcp exe download othermsbinaries t1105 bginfo exe execute wsh remote awl bypass wsh remote othermsbinaries t1218 cdb exe execute shellcode cmd othermsbinaries t1127 coregen exe execute dll awl bypass dll othermsbinaries t1055 t1218 createdump exe dump othermsbinaries t1003 csi exe execute csharp othermsbinaries t1127 defaultpack exe execute cmd othermsbinaries t1218 devinit exe execute msi remote othermsbinaries t1218 007 devtoolslauncher exe execute cmd othermsbinaries t1127 dnx exe execute csharp othermsbinaries t1127 dotnet exe awl bypass dll net csharp execute dll net fsharp othermsbinaries t1218 t1059 dsdbutil exe dump othermsbinaries t1003 003 dtutil exe copy othermsbinaries t1105 dump64 exe dump othermsbinaries t1003 001 dumpminitool exe dump othermsbinaries t1003 001 dxcap exe execute exe rename othermsbinaries t1127 ecmangen exe download inetcache othermsbinaries t1105 excel exe download inetcache othermsbinaries t1105 fsi exe awl bypass fsharp othermsbinaries t1059 fsianycpu exe awl bypass fsharp othermsbinaries t1059 intellitrace exe execute exe othermsbinaries t1127 logger exe execute cmd othermsbinaries t1202 mftrace exe execute exe othermsbinaries t1127 microsoft nodejstools pressanykey exe execute exe othermsbinaries t1127 mpiexec exe execute cmd othermsbinaries t1127 msaccess exe download inetcache othermsbinaries t1105 mscopilot exe execute cmd othermsbinaries t1218 015 mscopilot_proxy exe execute cmd othermsbinaries t1218 015 msdeploy exe execute cmd awl bypass cmd copy othermsbinaries t1218 t1105 msohtmed exe download inetcache othermsbinaries t1105 mspub exe download inetcache othermsbinaries t1105 msxsl exe execute xsl remote awl bypass xsl remote download alternate data streams othermsbinaries t1220 t1105 t1564 nmcap exe reconnaissance othermsbinaries t1040 ntdsutil exe dump othermsbinaries t1003 003 ntsd exe execute cmd othermsbinaries t1127 openconsole exe execute exe othermsbinaries t1202 outlook exe download inetcache othermsbinaries t1105 pixtool exe execute exe othermsbinaries t1127 powerpnt exe download inetcache othermsbinaries t1105 procdump exe execute dll othermsbinaries t1202 protocolhandler exe download othermsbinaries t1105 rcsi exe execute csharp awl bypass csharp othermsbinaries t1127 remote exe awl bypass exe execute exe remote othermsbinaries t1127 sqldumper exe dump othermsbinaries t1003 t1003 001 sqlps exe execute powershell othermsbinaries t1218 sqltoolsps exe execute powershell othermsbinaries t1218 squirrel exe download awl bypass nuget remote execute nuget remote othermsbinaries t1218 te exe execute wsh dll custom format othermsbinaries t1127 teams exe execute node js cmd othermsbinaries t1218 015 testwindowremoteagent exe upload othermsbinaries t1048 tracker exe execute dll awl bypass dll othermsbinaries t1127 update exe download awl bypass nuget remote cmd execute nuget remote cmd exe othermsbinaries t1218 t1547 t1070 vsdiagnostics exe execute exe cmd othermsbinaries t1127 vsiisexelauncher exe execute exe othermsbinaries t1218 visio exe download inetcache othermsbinaries t1105 visualuiaverifynative exe awl bypass netobjects othermsbinaries t1218 vslaunchbrowser exe download inetcache execute exe remote othermsbinaries t1105 t1127 vshadow exe execute exe othermsbinaries t1202 vsjitdebugger exe execute exe othermsbinaries t1127 wfmformat exe execute exe net framework 3 5 othermsbinaries t1127 wfc exe awl bypass xoml othermsbinaries t1127 windbg exe execute cmd othermsbinaries t1127 winproj exe download inetcache othermsbinaries t1105 winword exe download inetcache othermsbinaries t1105 wsb exe execute cmd othermsbinaries t1564 006 wsl exe execute exe cmd download othermsbinaries t1202 t1105 t1218 xbootmgr exe execute exe othermsbinaries t1202 xbootmgrsleep exe execute exe othermsbinaries t1202 devtunnel exe download othermsbinaries t1105 vsls agent exe execute dll othermsbinaries t1218 vstest console exe awl bypass dll othermsbinaries t1127 winfile exe execute exe othermsbinaries t1202 xsd exe download inetcache othermsbinaries t1105 cl_loadassembly ps1 execute dll net scripts t1216 cl_mutexverifiers ps1 execute powershell scripts t1216 cl_invocation ps1 execute cmd scripts t1216 launch vsdevshell ps1 execute exe scripts t1216 manage bde wsf execute exe scripts t1216 pubprn vbs execute sct scripts t1216 001 syncappvpublishingserver vbs execute powershell scripts t1216 002 utilityfunctions ps1 execute dll net scripts t1216 winrm vbs execute cmd remote awl bypass xsl scripts t1216 t1220 pester bat execute exe scripts t1216 no binary matches