thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Living Off the Land Binaries (LOLBins)

Legitimate, signed operating system binaries that attackers abuse to download, execute or hide malicious activity.

Definition

Common Windows LOLBins include certutil, mshta, rundll32, regsvr32, bitsadmin and wmic. The LOLBAS project documents their abusable functions, and GTFOBins does the same for Unix binaries. Monitoring their unusual use is a high-value detection strategy.

Example

rundll32.exe launching a DLL from a user's temp folder with an obscure export.

Exam tip

Know a few LOLBins by name; questions may show a suspicious command line and ask what technique it is.

Related terms