LOLBAS

Living Off The Land 二进制文件、脚本（现在还包括库） 所有不同的文件都可以通过一个漂亮的界面找到：https://lolbas-project.github.io（感谢 @ConsciousHacker 提供了美观的前端，以及 https://gtfobins.github.io/ 的团队）。 该仓库用于维护驱动前端展示的 YML 文件。 目标 LOLBAS 项目的目标是记录每一个可用于 Living Off The Land 技术的二进制文件、脚本和库。 标准 一个 LOLBin/Lib/Script 必须满足：...

goLoL

goLoL goLoL 是一款 Windows 主机扫描工具，同时支持 LOLBAS 可执行文件和 LOLDrivers 。它列出当前权限等级下可运行的 LOLBAS 技术（附带 MITRE ATT&CK 映射），并可扫描本地 .sys 文件，查找与易受攻击/恶意的 LOLDrivers 哈希匹配项。 注意： 这并不是一个 OPSEC 安全的工具。 作者： Aaron Kidwell █████ █████ ░░███ ░░███ ███████ ██████ ░███ ██████ ░███ ███░░███ ███░░███ ░███ ███░░███ ░███ ░███...

gtfocli

GTFOcli GTFOcli it's a Command Line Interface for easy binaries search commands that can be used to bypass local security restrictions in misconfigured systems. Table of Contents Table of Contents Installation Usage Search for Unix binaries Search for Windows binaries Search using dockerized...

LOLBins

LOLBins 用于列出 Windows 上所有“Living Off The Land”二进制文件和脚本（来自 LOLBAS）以及 Unix 上可用于绕过错误配置系统中本地安全限制的二进制文件（来自 GTFOBins）的 PyQT 应用程序。 Windows Linux...

Emmenhtal Loader Uses Scripts to Deliver Lumma and Other Malware

Emmenhtal Loader uses LOLBAS techniques, deploying malware like Lumma and Amadey through legitimate Windows tools. Its infection chain…...

LOLBAS in the Wild: 11 Living-Off-The-Land Binaries That Could Be Used for Malicious Purposes

Cybersecurity researchers have discovered a set of 11 living-off-the-land binaries-and-scripts LOLBAS that could be maliciously abused by threat actors to conduct post-exploitation activities. "LOLBAS is an attack method that uses binaries and scripts that are already part of the system for...

Brazilian Cybercriminals Using LOLBaS and CMD Scripts to Drain Bank Accounts

An unknown cybercrime threat actor has been observed targeting Spanish- and Portuguese-speaking victims to compromise online banking accounts in Mexico, Peru, and Portugal. "This threat actor employs tactics such as LOLBaS living-off-the-land binaries and scripts, along with CMD-based scripts to...

LOLBins - PyQT5 App For LOLBAS And GTFOBins

PyQT app to list all Living Off The Land Binaries and Scripts for Windows from LOLBAS and Unix binaries that can be used to bypass local security restrictions in misconfigured systems from GTFOBins. Widnows Linux Download LOLBins...

Detection evasion in CLR and tips on how to detect such attacks

In terms of costs, the age-old battle that pits attacker versus defender has become very one sided in recent years. Almost all modern attacks and ethical offensive exercises use Mimikatz, SharpHound, SeatBelt, Rubeus, GhostPack and other toolsets available to the community. This so-called...

Invoke-APT29: Adversarial Threat Emulation

MITRE recently conducted its second ATT&CK exercise in their ongoing annual series of Endpoint Security Efficacy testing and evaluation. This test focuses on assessing the behavioral capabilities of multiple endpoint security vendors against a simulated adversary, based closely around...

LOLBAS - Living Off The Land Binaries And Scripts (LOLBins And LOLScripts)

The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques. All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team ov...