LOLBins Named
Living-off-the-land binary literacy — defender detection framing on $LAB_RT, not weaponized LOLBin cookbooks on stranger domains.
Visual · t21_lolbins_named
LOLBins = signed OS tools abused in chains. Name + detect on $LAB_RT. Original Cyberlium.
LOLBins are detection puzzles for blue — learn the names and parent-child anomalies, not spray certutil on every domain you can ping.
Living-off-the-land binaries (LOLBins) are legitimate signed executables — PowerShell, certutil, mshta, rundll32, regsvr32, wmic, and similar — abused to download, execute, or proxy malicious actions while blending with admin activity. Red-team literacy maps LOLBin names to ATT&CK sub-techniques and documents suspicious command lines defenders hunt. Cyberlium teaches LOLBin categories and detection hypotheses on $LAB_RT per brief — NOT copy-paste one-liners against stranger SaaS, NOT obfuscated download cradles for unenrolled targets, NOT 'fileless' pride posts with live victim domains. Purple outcome: one LOLBin class → one Sigma-style detection idea → one log field — validation stays minimal on lab per RoE.
1. LOLBins (named)
Download: certutil, bitsadmin. Execute: mshta, rundll32, regsvr32. Script: powershell.exe with encoded args — name categories, not full attack scripts.
Hunter/red question: which parent process spawned the LOLBin, and is that normal for the role on this $LAB_RT host?
Command guide
Try these commands — LOLBins (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: curl, grep. Reference sites: LOLBAS project (https://lolbas-project.github.io/); LOLBAS GitHub (https://github.com/LOLBAS-Project/LOLBAS). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender detections
Command-line logging, AMSI/script block logging, parent-child process anomalies, constrained language mode, AppLocker/WDAC.
Baseline admin tasks vs emulation — purple team tunes rules on lab before production rollout.
3. Scope boundary
LOLBins literacy and brief-approved lab emulation on $LAB_RT only — read RoE on scripting and C2 interaction.
No LOLBin chains on employer prod, school servers, or internet strangers 'because defenders use them.'
4. What you ship: LOLBin literacy card
Three LOLBin names + abuse category + two detection ideas + NEVER stranger-domain cookbooks.
5. What you record before the next lesson
LOLBins literacy card path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Paste certutil download cradle against random company web apps from a forum.
- Right: Name LOLBins and detection angles on RoE lab. Next: Evasion vs Crime.
Mission: LOLBin literacy card
1) Define LOLBin in one line. 2) Name three binaries and abuse category each. 3) Write two detection hypotheses. 4) Write NEVER on unenrolled domains.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “LOLBins vs signed scripts — same detection?”
APPLY: LOLBins are:
APPLY: True or False: LOLBin cookbooks on stranger domains are lab.
APPLY: Defenders hunt LOLBins with: