Paste a Windows command or suspicious snippet and quickly check whether known LOLBAS binaries appear. The lookup runs in your browser for fast blue-team triage.
LOLBAS (Living Off The Land Binaries and Scripts) catalogs binaries and scripts that are legitimate on Windows (often Microsoft-signed) but that attackers may abuse to run code, load a DLL, exfiltrate data, or bypass controls - without dropping an unknown executable.
LOLBin usually means the same idea (an "off the land" binary). This tool compares your payload or command line against the LOLBAS project dataset (232 embedded entries, official lolbas.json format).
Detection by file names (.exe, .dll, etc.) and Windows paths.
// catalog references aligned with the official LOLBAS Project (lolbas-project.github.io)
Adversaries often abuse legitimate Windows binaries to blend into normal system activity. A LOLBAS checker helps analysts quickly map a pasted command to known living-off-the-land binaries and tactics - useful for SOC triage, detection engineering, and IR reviews.
Paste a command line, script snippet, or payload string.
Run the check to compare against the embedded catalog.
Review matches and validate with your telemetry context.
Living Off The Land Binaries and Scripts are legitimate Windows binaries that attackers may abuse. The LOLBAS Project catalogs known examples and defensive notes.
No. Matching uses embedded catalog data and runs in your browser. Nothing is uploaded for analysis by CyberHunter.
It helps triage whether known LOLBAS executables appear in a pasted command. It does not replace EDR or full command-line auditing.
From the official LOLBAS Project. Always refer to their site for the latest entries and guidance.
