lolbins

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

WelsonJS - Build apps with the Windows built-in JavaScript engine

Encyclopedia for Executables

** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.

Living Off Security Tools

Living off the land Data Exfiltration methods

Living off the Land (LOL) attack techniques, tools, and defender resources

Spoofing the Windows UAC "verified" publisher :)

A post-exploitation toolkit to simulate the weaponization and detection of native Windows binaries based on LOLBas framework.

Obfuscated PowerShell reverse shells for security research and testing purposes.

Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules. If you need help with implementation, contact@criticalmissions.be

A unified, interactive reference for Living Off The Land Binaries (LOLBAS & GTFOBins). Features a dynamic payload builder (LHOST/LPORT), real-time search, MITRE ATT&CK mapping, and auto-updates from official sources.

Windows batch script for system enumeration and spotting privilege-escalation routes. Stock cmd.exe only: no PowerShell, no wmic, no external tools.

Ultra-lightweight (~4KB) CLI tool to control Windows media playback. Built natively using csc.exe (Living Off the Land / LOLBin) without external dependencies.

GhostLNK is a professional-grade Windows LNK (shortcut) file generator with advanced stealth capabilities. It converts remote URLs (Dropbox, VPS, etc.) into PowerShell commands, encodes them in Base64, and embeds them into legitimate-looking LNK files that bypass modern AV detection.

LOLGEN: Living Off The Land Payload Generator

A library of post-exploitation MacOS scripts based on threat emulation, LOObins, CTI, and MITRE ATT&CK.

Ransomware dataset, containing dynamic behaviour of more than 60 distinct ransomware families.

A collection of specific commands used by threat actors, detailing their procedural implementations of tactics and techniques from the MITRE ATT&CK framework.