Paste a Windows command line from an alert, a log or a script and see which living off the land binaries it uses, with what the binary can be abused for and the matching MITRE ATT&CK techniques. 232 LOLBAS entries, checked in your browser.
LOLBAS (Living Off The Land Binaries and Scripts) catalogs binaries and scripts that are legitimate on Windows (often Microsoft-signed) but that attackers may abuse to run code, load a DLL, exfiltrate data, or bypass controls - without dropping an unknown executable.
LOLBin usually means the same idea (an "off the land" binary). This tool compares your payload or command line against the LOLBAS project dataset (232 embedded entries, official lolbas.json format).
Detection by file names (.exe, .dll, etc.) and Windows paths.
// catalog references aligned with the official LOLBAS Project (lolbas-project.github.io)
Adversaries often abuse legitimate Windows binaries to blend into normal system activity. A LOLBAS checker helps analysts quickly map a pasted command to known living-off-the-land binaries and tactics - useful for SOC triage, detection engineering, and IR reviews.
Paste a command line, script snippet, or payload string.
Run the check to compare against the embedded catalog.
Review matches and validate with your telemetry context.
A LOLBin (living off the land binary) is a legitimate, Microsoft-signed Windows program that attackers misuse to download files, run code or bypass application control without dropping their own malware. Because the binary is trusted, the activity blends in with normal administration.
Common ones in incident reports are certutil (download and decode files), mshta (run HTA or script code), rundll32 and regsvr32 (load DLLs or remote scriptlets), bitsadmin (background downloads), wmic, msbuild and PowerShell. Paste a command line to see which of the 232 cataloged binaries it involves.
Enable command-line logging (Sysmon event ID 1 or Windows event 4688 with command line), then look for these binaries with unusual parents (Office, browsers, web servers), network activity (certutil or mshta reaching the Internet) or arguments such as -urlcache, javascript: or scrobj.dll. This checker speeds up triage of a single command; EDR and SIEM rules do the continuous detection.
Living Off The Land Binaries and Scripts are legitimate Windows binaries that attackers may abuse. The LOLBAS Project catalogs known examples and defensive notes.
No. Matching uses embedded catalog data and runs in your browser. Nothing is uploaded for analysis by CyberHunter.
It helps triage whether known LOLBAS executables appear in a pasted command. It does not replace EDR or full command-line auditing.
From the official LOLBAS Project. Always refer to their site for the latest entries and guidance.
