LOLBin (living-off-the-land binary)

A LOLBin (living-off-the-land binary) is a legitimate program shipped with Windows, usually signed by Microsoft, that attackers abuse for purposes it was never meant to serve: downloading files, decoding payloads, executing scripts or proxying the execution of malicious DLLs. Classic examples include certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, msbuild.exe and wmic.exe. The community-maintained LOLBAS project catalogues these binaries and their abusable functions.

Attackers favour them because they are already present, trusted and often allowed by application control, so using them avoids dropping new tools on disk. For the investigator this means that the executable name alone is rarely suspicious; the context is what matters.

Look at the command line, the parent process, the user and the time. certutil fetching a URL, mshta launched by an Office application, or rundll32 loading a DLL from a user's temp folder are strong signals. Command lines come from process-creation events in the Windows event logs (when enabled) or from EDR telemetry, while Prefetch and other evidence of execution sources confirm that a binary ran and which files it touched. Some LOLBins leave dedicated traces: bitsadmin transfers, for instance, appear in the BITS jobs queue. LOLBin abuse frequently appears during lateral movement and when setting up persistence.