Red › Module 6 › Lesson 2
LOLBins Named
Living-off-the-land binary literacy — defender detection framing on $LAB_RT, not weaponized LOLBin cookbooks on stranger domains.
Visual · t21_lolbins_named
LOLBins = signed OS tools abused in chains. Name + detect on $LAB_RT. Original Cyberlium.
Opening
LOLBins are detection puzzles for blue — learn the names and parent-child anomalies, not spray certutil on every domain you can ping.
Living-off-the-land binaries (LOLBins) are legitimate signed executables — PowerShell, certutil, mshta, rundll32, regsvr32, wmic, and similar — abused to download, execute, or proxy malicious actions while blending with admin activity. Red-team literacy maps LOLBin names to ATT&CK sub-techniques and documents suspicious command lines defenders hunt. Cyberlium teaches LOLBin categories and detection hypotheses on $LAB_RT per brief — NOT copy-paste one-liners against stranger SaaS, NOT obfuscated download cradles for unenrolled targets, NOT 'fileless' pride posts with live victim domains. Purple outcome: one LOLBin class → one Sigma-style detection idea → one log field — validation stays minimal on lab per RoE.
1. LOLBins (named)
Download: certutil, bitsadmin. Execute: mshta, rundll32, regsvr32. Script: powershell.exe with encoded args — name categories, not full attack scripts.
Hunter/red question: which parent process spawned the LOLBin, and is that normal for the role on this $LAB_RT host?
Command guide
Try these commands — LOLBins (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
LOLBAS project — https://lolbas-project.github.io/ (living-off-the-land binaries literacy) LOLBAS GitHub — https://github.com/LOLBAS-Project/LOLBAS (lab enumeration only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://lolbas-project.github.io/ | grep -iE 'windows|linux' | head -5 curl -sS https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/README.md | head -10
═══ WINDOWS ═══
Command — copy this
Invoke-WebRequest -Uri https://lolbas-project.github.io/ -UseBasicParsing | Select-Object -ExpandProperty Content | Select-String -Pattern 'LOLBAS' | Select-Object -First 3
Primary tools to practice this lesson: curl, grep. Reference sites: LOLBAS project (https://lolbas-project.github.io/); LOLBAS GitHub (https://github.com/LOLBAS-Project/LOLBAS). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender detections
Command-line logging, AMSI/script block logging, parent-child process anomalies, constrained language mode, AppLocker/WDAC.
Baseline admin tasks vs emulation — purple team tunes rules on lab before production rollout.
3. Scope boundary
LOLBins literacy and brief-approved lab emulation on $LAB_RT only — read RoE on scripting and C2 interaction.
No LOLBin chains on employer prod, school servers, or internet strangers 'because defenders use them.'
4. What you ship: LOLBin literacy card
Three LOLBin names + abuse category + two detection ideas + NEVER stranger-domain cookbooks.
5. What you record before the next lesson
LOLBins literacy card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste certutil download cradle against random company web apps from a forum.
Right
Name LOLBins and detection angles on RoE lab. Next: Evasion vs Crime.
Mission: LOLBin literacy card
1) Define LOLBin in one line. 2) Name three binaries and abuse category each. 3) Write two detection hypotheses. 4) Write NEVER on unenrolled domains.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “LOLBins vs signed scripts — same detection?”
Knowledge Check
APPLY: LOLBins are:
Multiple choice
Knowledge Check
APPLY: True or False: LOLBin cookbooks on stranger domains are lab.
True or False
Knowledge Check
APPLY: Defenders hunt LOLBins with:
Multiple choice