tools.json - daemon-sec-lotl - DÆMONBins: GTFOBins × LOLBAS × WADComs × LOOBins in one filterable catalog

tools.json (303751B)
      1 [{"id":"gtfo:7z","name":"7z","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/7z/"],"count":2},{"id":"gtfo:R","name":"R","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/R/"],"count":3},{"id":"gtfo:aa-exec","name":"aa-exec","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aa-exec/"],"count":3},{"id":"gtfo:ab","name":"ab","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ab/"],"count":6},{"id":"gtfo:acr","name":"acr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/acr/"],"count":3},{"id":"gtfo:agetty","name":"agetty","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/agetty/"],"count":1},{"id":"gtfo:alpine","name":"alpine","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/alpine/"],"count":3},{"id":"gtfo:ansible-playbook","name":"ansible-playbook","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ansible-playbook/"],"count":2},{"id":"gtfo:ansible-test","name":"ansible-test","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ansible-test/"],"count":2},{"id":"gtfo:aoss","name":"aoss","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aoss/"],"count":2},{"id":"gtfo:apache2","name":"apache2","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/apache2/"],"count":6},{"id":"gtfo:apache2ctl","name":"apache2ctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/apache2ctl/"],"count":2},{"id":"gtfo:apport-cli","name":"apport-cli","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/apport-cli/"],"count":1},{"id":"gtfo:apt-get","name":"apt-get","source":"GTFOBins","platform":["Linux"],"aliases":["apt"],"references":["https://gtfobins.github.io/gtfobins/apt-get/"],"count":6},{"id":"gtfo:aptitude","name":"aptitude","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aptitude/"],"count":2},{"id":"gtfo:ar","name":"ar","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ar/"],"count":3},{"id":"gtfo:arch-nspawn","name":"arch-nspawn","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/arch-nspawn/"],"count":1},{"id":"gtfo:aria2c","name":"aria2c","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aria2c/"],"count":12},{"id":"gtfo:arj","name":"arj","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/arj/"],"count":6},{"id":"gtfo:arp","name":"arp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/arp/"],"count":3},{"id":"gtfo:as","name":"as","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/as/"],"count":3},{"id":"gtfo:ascii-xfr","name":"ascii-xfr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ascii-xfr/"],"count":3},{"id":"gtfo:ascii85","name":"ascii85","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ascii85/"],"count":2},{"id":"gtfo:ash","name":"ash","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ash/"],"count":6},{"id":"gtfo:aspell","name":"aspell","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aspell/"],"count":6},{"id":"gtfo:asterisk","name":"asterisk","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/asterisk/"],"count":3},{"id":"gtfo:at","name":"at","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/at/"],"count":4},{"id":"gtfo:atobm","name":"atobm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/atobm/"],"count":3},{"id":"gtfo:autoconf","name":"autoconf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/autoconf/"],"count":2},{"id":"gtfo:autoheader","name":"autoheader","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/autoheader/"],"count":2},{"id":"gtfo:autoreconf","name":"autoreconf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/autoreconf/"],"count":2},{"id":"gtfo:aws","name":"aws","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/aws/"],"count":5},{"id":"gtfo:base32","name":"base32","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/base32/"],"count":3},{"id":"gtfo:base58","name":"base58","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/base58/"],"count":2},{"id":"gtfo:base64","name":"base64","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/base64/"],"count":3},{"id":"gtfo:basenc","name":"basenc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/basenc/"],"count":3},{"id":"gtfo:basez","name":"basez","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/basez/"],"count":3},{"id":"gtfo:bash","name":"bash","source":"GTFOBins","platform":["Linux"],"aliases":["ksh"],"references":["https://gtfobins.github.io/gtfobins/bash/"],"count":33},{"id":"gtfo:bashbug","name":"bashbug","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bashbug/"],"count":2},{"id":"gtfo:batcat","name":"batcat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/batcat/"],"count":3},{"id":"gtfo:bbot","name":"bbot","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bbot/"],"count":2},{"id":"gtfo:bc","name":"bc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bc/"],"count":3},{"id":"gtfo:bconsole","name":"bconsole","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bconsole/"],"count":5},{"id":"gtfo:bee","name":"bee","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bee/"],"count":3},{"id":"gtfo:borg","name":"borg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/borg/"],"count":2},{"id":"gtfo:bpftrace","name":"bpftrace","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bpftrace/"],"count":3},{"id":"gtfo:bridge","name":"bridge","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bridge/"],"count":3},{"id":"gtfo:bundle","name":"bundle","source":"GTFOBins","platform":["Linux"],"aliases":["bundler"],"references":["https://gtfobins.github.io/gtfobins/bundle/"],"count":10},{"id":"gtfo:busctl","name":"busctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/busctl/"],"count":9},{"id":"gtfo:busybox","name":"busybox","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/busybox/"],"count":8},{"id":"gtfo:byebug","name":"byebug","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/byebug/"],"count":2},{"id":"gtfo:bzip2","name":"bzip2","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/bzip2/"],"count":3},{"id":"gtfo:cabal","name":"cabal","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cabal/"],"count":3},{"id":"gtfo:cancel","name":"cancel","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cancel/"],"count":3},{"id":"gtfo:capsh","name":"capsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/capsh/"],"count":3},{"id":"gtfo:cargo","name":"cargo","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cargo/"],"count":2},{"id":"gtfo:cat","name":"cat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cat/"],"count":3},{"id":"gtfo:cdist","name":"cdist","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cdist/"],"count":2},{"id":"gtfo:certbot","name":"certbot","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/certbot/"],"count":2},{"id":"gtfo:chattr","name":"chattr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/chattr/"],"count":2},{"id":"gtfo:check_by_ssh","name":"check_by_ssh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_by_ssh/"],"count":2},{"id":"gtfo:check_cups","name":"check_cups","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_cups/"],"count":2},{"id":"gtfo:check_log","name":"check_log","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_log/"],"count":4},{"id":"gtfo:check_memory","name":"check_memory","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_memory/"],"count":2},{"id":"gtfo:check_raid","name":"check_raid","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_raid/"],"count":2},{"id":"gtfo:check_ssl_cert","name":"check_ssl_cert","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_ssl_cert/"],"count":2},{"id":"gtfo:check_statusfile","name":"check_statusfile","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/check_statusfile/"],"count":2},{"id":"gtfo:chmod","name":"chmod","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/chmod/"],"count":2},{"id":"gtfo:choom","name":"choom","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/choom/"],"count":3},{"id":"gtfo:chown","name":"chown","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/chown/"],"count":2},{"id":"gtfo:chroot","name":"chroot","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/chroot/"],"count":2},{"id":"gtfo:chrt","name":"chrt","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/chrt/"],"count":3},{"id":"gtfo:clamscan","name":"clamscan","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/clamscan/"],"count":3},{"id":"gtfo:clisp","name":"clisp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/clisp/"],"count":3},{"id":"gtfo:cmake","name":"cmake","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cmake/"],"count":4},{"id":"gtfo:cmp","name":"cmp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cmp/"],"count":3},{"id":"gtfo:cobc","name":"cobc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cobc/"],"count":3},{"id":"gtfo:code","name":"code","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/code/"],"count":6},{"id":"gtfo:codex","name":"codex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/codex/"],"count":2},{"id":"gtfo:column","name":"column","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/column/"],"count":3},{"id":"gtfo:comm","name":"comm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/comm/"],"count":3},{"id":"gtfo:composer","name":"composer","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/composer/"],"count":2},{"id":"gtfo:cowsay","name":"cowsay","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cowsay/"],"count":2},{"id":"gtfo:cowthink","name":"cowthink","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cowthink/"],"count":2},{"id":"gtfo:cp","name":"cp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cp/"],"count":10},{"id":"gtfo:cpan","name":"cpan","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cpan/"],"count":2},{"id":"gtfo:cpio","name":"cpio","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cpio/"],"count":10},{"id":"gtfo:cpulimit","name":"cpulimit","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cpulimit/"],"count":3},{"id":"gtfo:crash","name":"crash","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/crash/"],"count":5},{"id":"gtfo:crontab","name":"crontab","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/crontab/"],"count":4},{"id":"gtfo:csh","name":"csh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/csh/"],"count":6},{"id":"gtfo:csplit","name":"csplit","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/csplit/"],"count":6},{"id":"gtfo:csvtool","name":"csvtool","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/csvtool/"],"count":9},{"id":"gtfo:ctr","name":"ctr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ctr/"],"count":2},{"id":"gtfo:cupsfilter","name":"cupsfilter","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cupsfilter/"],"count":3},{"id":"gtfo:curl","name":"curl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/curl/"],"count":21},{"id":"gtfo:cut","name":"cut","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/cut/"],"count":3},{"id":"gtfo:dash","name":"dash","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dash/"],"count":6},{"id":"gtfo:date","name":"date","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/date/"],"count":3},{"id":"gtfo:dc","name":"dc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dc/"],"count":3},{"id":"gtfo:dd","name":"dd","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dd/"],"count":6},{"id":"gtfo:debugfs","name":"debugfs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/debugfs/"],"count":3},{"id":"gtfo:dhclient","name":"dhclient","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dhclient/"],"count":2},{"id":"gtfo:dialog","name":"dialog","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dialog/"],"count":3},{"id":"gtfo:diff","name":"diff","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/diff/"],"count":6},{"id":"gtfo:dig","name":"dig","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dig/"],"count":3},{"id":"gtfo:distcc","name":"distcc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/distcc/"],"count":3},{"id":"gtfo:dmesg","name":"dmesg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dmesg/"],"count":6},{"id":"gtfo:dmidecode","name":"dmidecode","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dmidecode/"],"count":1},{"id":"gtfo:dmsetup","name":"dmsetup","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dmsetup/"],"count":3},{"id":"gtfo:dnf","name":"dnf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dnf/"],"count":1},{"id":"gtfo:dnsmasq","name":"dnsmasq","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dnsmasq/"],"count":3},{"id":"gtfo:doas","name":"doas","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/doas/"],"count":2},{"id":"gtfo:docker","name":"docker","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/docker/"],"count":12},{"id":"gtfo:dos2unix","name":"dos2unix","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dos2unix/"],"count":6},{"id":"gtfo:dosbox","name":"dosbox","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dosbox/"],"count":9},{"id":"gtfo:dotnet","name":"dotnet","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dotnet/"],"count":4},{"id":"gtfo:dpkg","name":"dpkg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dpkg/"],"count":4},{"id":"gtfo:dstat","name":"dstat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dstat/"],"count":2},{"id":"gtfo:dvips","name":"dvips","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/dvips/"],"count":3},{"id":"gtfo:easy_install","name":"easy_install","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/easy_install/"],"count":2},{"id":"gtfo:easyrsa","name":"easyrsa","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/easyrsa/"],"count":3},{"id":"gtfo:eb","name":"eb","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/eb/"],"count":2},{"id":"gtfo:ed","name":"ed","source":"GTFOBins","platform":["Linux"],"aliases":["red"],"references":["https://gtfobins.github.io/gtfobins/ed/"],"count":9},{"id":"gtfo:efax","name":"efax","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/efax/"],"count":2},{"id":"gtfo:egrep","name":"egrep","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/egrep/"],"count":3},{"id":"gtfo:elvish","name":"elvish","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/elvish/"],"count":9},{"id":"gtfo:emacs","name":"emacs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/emacs/"],"count":6},{"id":"gtfo:enscript","name":"enscript","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/enscript/"],"count":3},{"id":"gtfo:env","name":"env","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/env/"],"count":3},{"id":"gtfo:eqn","name":"eqn","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/eqn/"],"count":3},{"id":"gtfo:espeak","name":"espeak","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/espeak/"],"count":3},{"id":"gtfo:ex","name":"ex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ex/"],"count":6},{"id":"gtfo:exiftool","name":"exiftool","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/exiftool/"],"count":12},{"id":"gtfo:expand","name":"expand","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/expand/"],"count":3},{"id":"gtfo:expect","name":"expect","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/expect/"],"count":6},{"id":"gtfo:facter","name":"facter","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/facter/"],"count":4},{"id":"gtfo:fail2ban-client","name":"fail2ban-client","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fail2ban-client/"],"count":2},{"id":"gtfo:fastfetch","name":"fastfetch","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fastfetch/"],"count":9},{"id":"gtfo:ffmpeg","name":"ffmpeg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ffmpeg/"],"count":3},{"id":"gtfo:fgrep","name":"fgrep","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fgrep/"],"count":3},{"id":"gtfo:file","name":"file","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/file/"],"count":6},{"id":"gtfo:find","name":"find","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/find/"],"count":9},{"id":"gtfo:finger","name":"finger","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/finger/"],"count":6},{"id":"gtfo:firejail","name":"firejail","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/firejail/"],"count":2},{"id":"gtfo:fish","name":"fish","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fish/"],"count":3},{"id":"gtfo:flock","name":"flock","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/flock/"],"count":3},{"id":"gtfo:fmt","name":"fmt","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fmt/"],"count":6},{"id":"gtfo:fold","name":"fold","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fold/"],"count":3},{"id":"gtfo:forge","name":"forge","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/forge/"],"count":3},{"id":"gtfo:fping","name":"fping","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fping/"],"count":3},{"id":"gtfo:ftp","name":"ftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ftp/"],"count":9},{"id":"gtfo:fzf","name":"fzf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/fzf/"],"count":6},{"id":"gtfo:gawk","name":"gawk","source":"GTFOBins","platform":["Linux"],"aliases":["nawk"],"references":["https://gtfobins.github.io/gtfobins/gawk/"],"count":15},{"id":"gtfo:gcc","name":"gcc","source":"GTFOBins","platform":["Linux"],"aliases":["c89","c99","cc","g++"],"references":["https://gtfobins.github.io/gtfobins/gcc/"],"count":8},{"id":"gtfo:gcloud","name":"gcloud","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gcloud/"],"count":3},{"id":"gtfo:gcore","name":"gcore","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gcore/"],"count":3},{"id":"gtfo:gdb","name":"gdb","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gdb/"],"count":10},{"id":"gtfo:gem","name":"gem","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gem/"],"count":8},{"id":"gtfo:genie","name":"genie","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/genie/"],"count":3},{"id":"gtfo:genisoimage","name":"genisoimage","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/genisoimage/"],"count":6},{"id":"gtfo:getent","name":"getent","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/getent/"],"count":2},{"id":"gtfo:ghc","name":"ghc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ghc/"],"count":2},{"id":"gtfo:ghci","name":"ghci","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ghci/"],"count":2},{"id":"gtfo:gimp","name":"gimp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gimp/"],"count":2},{"id":"gtfo:ginsh","name":"ginsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ginsh/"],"count":3},{"id":"gtfo:git","name":"git","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/git/"],"count":17},{"id":"gtfo:gnuplot","name":"gnuplot","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gnuplot/"],"count":3},{"id":"gtfo:go","name":"go","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/go/"],"count":10},{"id":"gtfo:grc","name":"grc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/grc/"],"count":2},{"id":"gtfo:grep","name":"grep","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/grep/"],"count":3},{"id":"gtfo:gtester","name":"gtester","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gtester/"],"count":6},{"id":"gtfo:guile","name":"guile","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/guile/"],"count":3},{"id":"gtfo:gzip","name":"gzip","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/gzip/"],"count":4},{"id":"gtfo:hashcat","name":"hashcat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/hashcat/"],"count":2},{"id":"gtfo:head","name":"head","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/head/"],"count":3},{"id":"gtfo:hexdump","name":"hexdump","source":"GTFOBins","platform":["Linux"],"aliases":["hd"],"references":["https://gtfobins.github.io/gtfobins/hexdump/"],"count":3},{"id":"gtfo:hg","name":"hg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/hg/"],"count":3},{"id":"gtfo:highlight","name":"highlight","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/highlight/"],"count":3},{"id":"gtfo:hping3","name":"hping3","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/hping3/"],"count":4},{"id":"gtfo:iconv","name":"iconv","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/iconv/"],"count":6},{"id":"gtfo:iftop","name":"iftop","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/iftop/"],"count":3},{"id":"gtfo:install","name":"install","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/install/"],"count":2},{"id":"gtfo:ionice","name":"ionice","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ionice/"],"count":3},{"id":"gtfo:ip","name":"ip","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ip/"],"count":6},{"id":"gtfo:iptables-save","name":"iptables-save","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/iptables-save/"],"count":1},{"id":"gtfo:irb","name":"irb","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/irb/"],"count":2},{"id":"gtfo:ispell","name":"ispell","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ispell/"],"count":3},{"id":"gtfo:java","name":"java","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/java/"],"count":2},{"id":"gtfo:jjs","name":"jjs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/jjs/"],"count":10},{"id":"gtfo:joe","name":"joe","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/joe/"],"count":3},{"id":"gtfo:join","name":"join","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/join/"],"count":3},{"id":"gtfo:journalctl","name":"journalctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/journalctl/"],"count":2},{"id":"gtfo:jq","name":"jq","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/jq/"],"count":3},{"id":"gtfo:jrunscript","name":"jrunscript","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/jrunscript/"],"count":11},{"id":"gtfo:jshell","name":"jshell","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/jshell/"],"count":6},{"id":"gtfo:jtag","name":"jtag","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/jtag/"],"count":2},{"id":"gtfo:julia","name":"julia","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/julia/"],"count":15},{"id":"gtfo:knife","name":"knife","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/knife/"],"count":2},{"id":"gtfo:ksshell","name":"ksshell","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ksshell/"],"count":3},{"id":"gtfo:ksu","name":"ksu","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ksu/"],"count":1},{"id":"gtfo:kubectl","name":"kubectl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/kubectl/"],"count":5},{"id":"gtfo:last","name":"last","source":"GTFOBins","platform":["Linux"],"aliases":["lastb"],"references":["https://gtfobins.github.io/gtfobins/last/"],"count":3},{"id":"gtfo:latex","name":"latex","source":"GTFOBins","platform":["Linux"],"aliases":["xelatex"],"references":["https://gtfobins.github.io/gtfobins/latex/"],"count":9},{"id":"gtfo:latexmk","name":"latexmk","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/latexmk/"],"count":6},{"id":"gtfo:ld.so","name":"ld.so","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ld.so/"],"count":3},{"id":"gtfo:ldconfig","name":"ldconfig","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ldconfig/"],"count":3},{"id":"gtfo:less","name":"less","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/less/"],"count":24},{"id":"gtfo:lftp","name":"lftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lftp/"],"count":3},{"id":"gtfo:links","name":"links","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/links/"],"count":3},{"id":"gtfo:ln","name":"ln","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ln/"],"count":1},{"id":"gtfo:loginctl","name":"loginctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/loginctl/"],"count":2},{"id":"gtfo:logrotate","name":"logrotate","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/logrotate/"],"count":7},{"id":"gtfo:logsave","name":"logsave","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/logsave/"],"count":3},{"id":"gtfo:look","name":"look","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/look/"],"count":3},{"id":"gtfo:lp","name":"lp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lp/"],"count":3},{"id":"gtfo:ltrace","name":"ltrace","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ltrace/"],"count":7},{"id":"gtfo:lua","name":"lua","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lua/"],"count":21},{"id":"gtfo:lualatex","name":"lualatex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lualatex/"],"count":3},{"id":"gtfo:luatex","name":"luatex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/luatex/"],"count":3},{"id":"gtfo:lwp-download","name":"lwp-download","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lwp-download/"],"count":8},{"id":"gtfo:lwp-request","name":"lwp-request","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lwp-request/"],"count":2},{"id":"gtfo:lxd","name":"lxd","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/lxd/"],"count":4},{"id":"gtfo:m4","name":"m4","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/m4/"],"count":9},{"id":"gtfo:mail","name":"mail","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mail/"],"count":6},{"id":"gtfo:make","name":"make","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/make/"],"count":9},{"id":"gtfo:man","name":"man","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/man/"],"count":9},{"id":"gtfo:mawk","name":"mawk","source":"GTFOBins","platform":["Linux"],"aliases":["awk"],"references":["https://gtfobins.github.io/gtfobins/mawk/"],"count":9},{"id":"gtfo:minicom","name":"minicom","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/minicom/"],"count":6},{"id":"gtfo:more","name":"more","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/more/"],"count":6},{"id":"gtfo:mosh-server","name":"mosh-server","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mosh-server/"],"count":1},{"id":"gtfo:mosquitto","name":"mosquitto","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mosquitto/"],"count":3},{"id":"gtfo:mount","name":"mount","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mount/"],"count":1},{"id":"gtfo:msfconsole","name":"msfconsole","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msfconsole/"],"count":2},{"id":"gtfo:msgattrib","name":"msgattrib","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msgattrib/"],"count":3},{"id":"gtfo:msgcat","name":"msgcat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msgcat/"],"count":3},{"id":"gtfo:msgconv","name":"msgconv","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msgconv/"],"count":3},{"id":"gtfo:msgfilter","name":"msgfilter","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msgfilter/"],"count":6},{"id":"gtfo:msgmerge","name":"msgmerge","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msgmerge/"],"count":3},{"id":"gtfo:msguniq","name":"msguniq","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/msguniq/"],"count":3},{"id":"gtfo:mtr","name":"mtr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mtr/"],"count":2},{"id":"gtfo:multitime","name":"multitime","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/multitime/"],"count":3},{"id":"gtfo:mutt","name":"mutt","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mutt/"],"count":2},{"id":"gtfo:mv","name":"mv","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mv/"],"count":5},{"id":"gtfo:mypy","name":"mypy","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mypy/"],"count":4},{"id":"gtfo:mysql","name":"mysql","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/mysql/"],"count":6},{"id":"gtfo:nano","name":"nano","source":"GTFOBins","platform":["Linux"],"aliases":["pico"],"references":["https://gtfobins.github.io/gtfobins/nano/"],"count":12},{"id":"gtfo:nasm","name":"nasm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nasm/"],"count":3},{"id":"gtfo:nc","name":"nc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nc/"],"count":18},{"id":"gtfo:ncdu","name":"ncdu","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ncdu/"],"count":3},{"id":"gtfo:ncftp","name":"ncftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ncftp/"],"count":3},{"id":"gtfo:needrestart","name":"needrestart","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/needrestart/"],"count":2},{"id":"gtfo:neofetch","name":"neofetch","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/neofetch/"],"count":4},{"id":"gtfo:nft","name":"nft","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nft/"],"count":2},{"id":"gtfo:nginx","name":"nginx","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nginx/"],"count":5},{"id":"gtfo:nice","name":"nice","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nice/"],"count":3},{"id":"gtfo:nl","name":"nl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nl/"],"count":3},{"id":"gtfo:nm","name":"nm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nm/"],"count":3},{"id":"gtfo:nmap","name":"nmap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nmap/"],"count":12},{"id":"gtfo:node","name":"node","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/node/"],"count":22},{"id":"gtfo:nohup","name":"nohup","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nohup/"],"count":6},{"id":"gtfo:npm","name":"npm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/npm/"],"count":6},{"id":"gtfo:nroff","name":"nroff","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nroff/"],"count":4},{"id":"gtfo:nsenter","name":"nsenter","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/nsenter/"],"count":3},{"id":"gtfo:ntpdate","name":"ntpdate","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ntpdate/"],"count":3},{"id":"gtfo:octave","name":"octave","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/octave/"],"count":9},{"id":"gtfo:od","name":"od","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/od/"],"count":3},{"id":"gtfo:opencode","name":"opencode","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/opencode/"],"count":5},{"id":"gtfo:openssl","name":"openssl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/openssl/"],"count":21},{"id":"gtfo:openvpn","name":"openvpn","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/openvpn/"],"count":6},{"id":"gtfo:openvt","name":"openvt","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/openvt/"],"count":1},{"id":"gtfo:opkg","name":"opkg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/opkg/"],"count":1},{"id":"gtfo:pandoc","name":"pandoc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pandoc/"],"count":9},{"id":"gtfo:passwd","name":"passwd","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/passwd/"],"count":1},{"id":"gtfo:paste","name":"paste","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/paste/"],"count":3},{"id":"gtfo:pax","name":"pax","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pax/"],"count":3},{"id":"gtfo:pdb","name":"pdb","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pdb/"],"count":2},{"id":"gtfo:pdflatex","name":"pdflatex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pdflatex/"],"count":9},{"id":"gtfo:pdftex","name":"pdftex","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pdftex/"],"count":3},{"id":"gtfo:perf","name":"perf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/perf/"],"count":3},{"id":"gtfo:perl","name":"perl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/perl/"],"count":14},{"id":"gtfo:perlbug","name":"perlbug","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/perlbug/"],"count":2},{"id":"gtfo:pexec","name":"pexec","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pexec/"],"count":3},{"id":"gtfo:pg","name":"pg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pg/"],"count":6},{"id":"gtfo:php","name":"php","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/php/"],"count":40},{"id":"gtfo:pic","name":"pic","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pic/"],"count":6},{"id":"gtfo:pidstat","name":"pidstat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pidstat/"],"count":3},{"id":"gtfo:pip","name":"pip","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pip/"],"count":4},{"id":"gtfo:pipx","name":"pipx","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pipx/"],"count":2},{"id":"gtfo:pkexec","name":"pkexec","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pkexec/"],"count":1},{"id":"gtfo:pkg","name":"pkg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pkg/"],"count":1},{"id":"gtfo:plymouth","name":"plymouth","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/plymouth/"],"count":3},{"id":"gtfo:podman","name":"podman","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/podman/"],"count":2},{"id":"gtfo:poetry","name":"poetry","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/poetry/"],"count":2},{"id":"gtfo:posh","name":"posh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/posh/"],"count":2},{"id":"gtfo:pr","name":"pr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pr/"],"count":3},{"id":"gtfo:procmail","name":"procmail","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/procmail/"],"count":2},{"id":"gtfo:pry","name":"pry","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pry/"],"count":2},{"id":"gtfo:psftp","name":"psftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/psftp/"],"count":3},{"id":"gtfo:psql","name":"psql","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/psql/"],"count":6},{"id":"gtfo:ptx","name":"ptx","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ptx/"],"count":3},{"id":"gtfo:puppet","name":"puppet","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/puppet/"],"count":6},{"id":"gtfo:pwsh","name":"pwsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pwsh/"],"count":4},{"id":"gtfo:pygmentize","name":"pygmentize","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pygmentize/"],"count":2},{"id":"gtfo:pyright","name":"pyright","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/pyright/"],"count":6},{"id":"gtfo:python","name":"python","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/python/"],"count":26},{"id":"gtfo:qpdf","name":"qpdf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/qpdf/"],"count":3},{"id":"gtfo:rake","name":"rake","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rake/"],"count":4},{"id":"gtfo:ranger","name":"ranger","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ranger/"],"count":2},{"id":"gtfo:rc","name":"rc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rc/"],"count":3},{"id":"gtfo:readelf","name":"readelf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/readelf/"],"count":3},{"id":"gtfo:redcarpet","name":"redcarpet","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/redcarpet/"],"count":2},{"id":"gtfo:redis","name":"redis","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/redis/"],"count":3},{"id":"gtfo:restic","name":"restic","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/restic/"],"count":15},{"id":"gtfo:rev","name":"rev","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rev/"],"count":3},{"id":"gtfo:rlogin","name":"rlogin","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rlogin/"],"count":3},{"id":"gtfo:rlwrap","name":"rlwrap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rlwrap/"],"count":6},{"id":"gtfo:rpm","name":"rpm","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rpm/"],"count":10},{"id":"gtfo:rpmdb","name":"rpmdb","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rpmdb/"],"count":6},{"id":"gtfo:rpmquery","name":"rpmquery","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rpmquery/"],"count":6},{"id":"gtfo:rpmverify","name":"rpmverify","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rpmverify/"],"count":6},{"id":"gtfo:rsync","name":"rsync","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rsync/"],"count":3},{"id":"gtfo:rsyslogd","name":"rsyslogd","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rsyslogd/"],"count":1},{"id":"gtfo:rtorrent","name":"rtorrent","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rtorrent/"],"count":3},{"id":"gtfo:ruby","name":"ruby","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ruby/"],"count":15},{"id":"gtfo:run-mailcap","name":"run-mailcap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/run-mailcap/"],"count":4},{"id":"gtfo:run-parts","name":"run-parts","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/run-parts/"],"count":6},{"id":"gtfo:runscript","name":"runscript","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/runscript/"],"count":3},{"id":"gtfo:rustc","name":"rustc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rustc/"],"count":6},{"id":"gtfo:rustdoc","name":"rustdoc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rustdoc/"],"count":4},{"id":"gtfo:rustfmt","name":"rustfmt","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rustfmt/"],"count":2},{"id":"gtfo:rustup","name":"rustup","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/rustup/"],"count":4},{"id":"gtfo:sash","name":"sash","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sash/"],"count":3},{"id":"gtfo:scanmem","name":"scanmem","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/scanmem/"],"count":3},{"id":"gtfo:scp","name":"scp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/scp/"],"count":12},{"id":"gtfo:screen","name":"screen","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/screen/"],"count":6},{"id":"gtfo:script","name":"script","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/script/"],"count":6},{"id":"gtfo:scrot","name":"scrot","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/scrot/"],"count":3},{"id":"gtfo:sed","name":"sed","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sed/"],"count":12},{"id":"gtfo:service","name":"service","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/service/"],"count":2},{"id":"gtfo:setarch","name":"setarch","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/setarch/"],"count":3},{"id":"gtfo:setcap","name":"setcap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/setcap/"],"count":2},{"id":"gtfo:setfacl","name":"setfacl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/setfacl/"],"count":2},{"id":"gtfo:setlock","name":"setlock","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/setlock/"],"count":3},{"id":"gtfo:sftp","name":"sftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sftp/"],"count":9},{"id":"gtfo:sg","name":"sg","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sg/"],"count":2},{"id":"gtfo:shred","name":"shred","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/shred/"],"count":3},{"id":"gtfo:shuf","name":"shuf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/shuf/"],"count":6},{"id":"gtfo:slsh","name":"slsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/slsh/"],"count":3},{"id":"gtfo:smbclient","name":"smbclient","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/smbclient/"],"count":6},{"id":"gtfo:snap","name":"snap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/snap/"],"count":1},{"id":"gtfo:socat","name":"socat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/socat/"],"count":21},{"id":"gtfo:socket","name":"socket","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/socket/"],"count":6},{"id":"gtfo:soelim","name":"soelim","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/soelim/"],"count":3},{"id":"gtfo:softlimit","name":"softlimit","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/softlimit/"],"count":3},{"id":"gtfo:sort","name":"sort","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sort/"],"count":6},{"id":"gtfo:split","name":"split","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/split/"],"count":9},{"id":"gtfo:sqlite3","name":"sqlite3","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sqlite3/"],"count":9},{"id":"gtfo:sqlmap","name":"sqlmap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sqlmap/"],"count":2},{"id":"gtfo:ss","name":"ss","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ss/"],"count":3},{"id":"gtfo:ssh","name":"ssh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ssh/"],"count":16},{"id":"gtfo:ssh-agent","name":"ssh-agent","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ssh-agent/"],"count":3},{"id":"gtfo:ssh-copy-id","name":"ssh-copy-id","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ssh-copy-id/"],"count":4},{"id":"gtfo:ssh-keygen","name":"ssh-keygen","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ssh-keygen/"],"count":3},{"id":"gtfo:ssh-keyscan","name":"ssh-keyscan","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ssh-keyscan/"],"count":3},{"id":"gtfo:sshfs","name":"sshfs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sshfs/"],"count":6},{"id":"gtfo:sshpass","name":"sshpass","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sshpass/"],"count":3},{"id":"gtfo:sshuttle","name":"sshuttle","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sshuttle/"],"count":1},{"id":"gtfo:start-stop-daemon","name":"start-stop-daemon","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/start-stop-daemon/"],"count":3},{"id":"gtfo:stdbuf","name":"stdbuf","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/stdbuf/"],"count":3},{"id":"gtfo:strace","name":"strace","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/strace/"],"count":5},{"id":"gtfo:strings","name":"strings","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/strings/"],"count":3},{"id":"gtfo:su","name":"su","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/su/"],"count":1},{"id":"gtfo:sudo","name":"sudo","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sudo/"],"count":1},{"id":"gtfo:sysctl","name":"sysctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/sysctl/"],"count":5},{"id":"gtfo:systemctl","name":"systemctl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/systemctl/"],"count":6},{"id":"gtfo:systemd-resolve","name":"systemd-resolve","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/systemd-resolve/"],"count":1},{"id":"gtfo:systemd-run","name":"systemd-run","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/systemd-run/"],"count":3},{"id":"gtfo:tac","name":"tac","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tac/"],"count":3},{"id":"gtfo:tail","name":"tail","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tail/"],"count":3},{"id":"gtfo:tailscale","name":"tailscale","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tailscale/"],"count":1},{"id":"gtfo:tar","name":"tar","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tar/"],"count":21},{"id":"gtfo:task","name":"task","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/task/"],"count":3},{"id":"gtfo:taskset","name":"taskset","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/taskset/"],"count":2},{"id":"gtfo:tasksh","name":"tasksh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tasksh/"],"count":3},{"id":"gtfo:tbl","name":"tbl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tbl/"],"count":3},{"id":"gtfo:tclsh","name":"tclsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tclsh/"],"count":10},{"id":"gtfo:tcpdump","name":"tcpdump","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tcpdump/"],"count":7},{"id":"gtfo:tcsh","name":"tcsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tcsh/"],"count":6},{"id":"gtfo:tdbtool","name":"tdbtool","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tdbtool/"],"count":3},{"id":"gtfo:tee","name":"tee","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tee/"],"count":3},{"id":"gtfo:telnet","name":"telnet","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/telnet/"],"count":6},{"id":"gtfo:terraform","name":"terraform","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/terraform/"],"count":3},{"id":"gtfo:tex","name":"tex","source":"GTFOBins","platform":["Linux"],"aliases":["xetex"],"references":["https://gtfobins.github.io/gtfobins/tex/"],"count":3},{"id":"gtfo:tftp","name":"tftp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tftp/"],"count":6},{"id":"gtfo:tic","name":"tic","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tic/"],"count":3},{"id":"gtfo:time","name":"time","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/time/"],"count":3},{"id":"gtfo:timedatectl","name":"timedatectl","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/timedatectl/"],"count":2},{"id":"gtfo:timeout","name":"timeout","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/timeout/"],"count":3},{"id":"gtfo:tmate","name":"tmate","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tmate/"],"count":3},{"id":"gtfo:tmux","name":"tmux","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tmux/"],"count":9},{"id":"gtfo:top","name":"top","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/top/"],"count":2},{"id":"gtfo:torify","name":"torify","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/torify/"],"count":2},{"id":"gtfo:torsocks","name":"torsocks","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/torsocks/"],"count":2},{"id":"gtfo:troff","name":"troff","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/troff/"],"count":3},{"id":"gtfo:tsc","name":"tsc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tsc/"],"count":4},{"id":"gtfo:tshark","name":"tshark","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/tshark/"],"count":2},{"id":"gtfo:ul","name":"ul","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/ul/"],"count":3},{"id":"gtfo:unexpand","name":"unexpand","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/unexpand/"],"count":3},{"id":"gtfo:uniq","name":"uniq","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/uniq/"],"count":3},{"id":"gtfo:unshare","name":"unshare","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/unshare/"],"count":3},{"id":"gtfo:unsquashfs","name":"unsquashfs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/unsquashfs/"],"count":2},{"id":"gtfo:unzip","name":"unzip","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/unzip/"],"count":2},{"id":"gtfo:update-alternatives","name":"update-alternatives","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/update-alternatives/"],"count":2},{"id":"gtfo:urlget","name":"urlget","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/urlget/"],"count":3},{"id":"gtfo:uuencode","name":"uuencode","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/uuencode/"],"count":3},{"id":"gtfo:uv","name":"uv","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/uv/"],"count":2},{"id":"gtfo:vagrant","name":"vagrant","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/vagrant/"],"count":2},{"id":"gtfo:valgrind","name":"valgrind","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/valgrind/"],"count":2},{"id":"gtfo:varnishncsa","name":"varnishncsa","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/varnishncsa/"],"count":2},{"id":"gtfo:vi","name":"vi","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/vi/"],"count":18},{"id":"gtfo:vigr","name":"vigr","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/vigr/"],"count":2},{"id":"gtfo:vim","name":"vim","source":"GTFOBins","platform":["Linux"],"aliases":["nvim","rvim","view","vimdiff"],"references":["https://gtfobins.github.io/gtfobins/vim/"],"count":12},{"id":"gtfo:vipw","name":"vipw","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/vipw/"],"count":2},{"id":"gtfo:virsh","name":"virsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/virsh/"],"count":5},{"id":"gtfo:volatility","name":"volatility","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/volatility/"],"count":3},{"id":"gtfo:w3m","name":"w3m","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/w3m/"],"count":3},{"id":"gtfo:wall","name":"wall","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wall/"],"count":1},{"id":"gtfo:watch","name":"watch","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/watch/"],"count":6},{"id":"gtfo:wc","name":"wc","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wc/"],"count":3},{"id":"gtfo:wg-quick","name":"wg-quick","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wg-quick/"],"count":1},{"id":"gtfo:wget","name":"wget","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wget/"],"count":18},{"id":"gtfo:whiptail","name":"whiptail","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/whiptail/"],"count":3},{"id":"gtfo:whois","name":"whois","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/whois/"],"count":6},{"id":"gtfo:wireshark","name":"wireshark","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wireshark/"],"count":4},{"id":"gtfo:wish","name":"wish","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/wish/"],"count":3},{"id":"gtfo:xargs","name":"xargs","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xargs/"],"count":12},{"id":"gtfo:xdg-user-dir","name":"xdg-user-dir","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xdg-user-dir/"],"count":2},{"id":"gtfo:xdotool","name":"xdotool","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xdotool/"],"count":3},{"id":"gtfo:xmodmap","name":"xmodmap","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xmodmap/"],"count":3},{"id":"gtfo:xmore","name":"xmore","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xmore/"],"count":3},{"id":"gtfo:xpad","name":"xpad","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xpad/"],"count":3},{"id":"gtfo:xxd","name":"xxd","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xxd/"],"count":6},{"id":"gtfo:xz","name":"xz","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/xz/"],"count":3},{"id":"gtfo:yarn","name":"yarn","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/yarn/"],"count":6},{"id":"gtfo:yash","name":"yash","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/yash/"],"count":3},{"id":"gtfo:yelp","name":"yelp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/yelp/"],"count":2},{"id":"gtfo:yt-dlp","name":"yt-dlp","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/yt-dlp/"],"count":2},{"id":"gtfo:yum","name":"yum","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/yum/"],"count":3},{"id":"gtfo:zathura","name":"zathura","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zathura/"],"count":2},{"id":"gtfo:zcat","name":"zcat","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zcat/"],"count":2},{"id":"gtfo:zgrep","name":"zgrep","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zgrep/"],"count":2},{"id":"gtfo:zic","name":"zic","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zic/"],"count":3},{"id":"gtfo:zip","name":"zip","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zip/"],"count":6},{"id":"gtfo:zless","name":"zless","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zless/"],"count":3},{"id":"gtfo:zsh","name":"zsh","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zsh/"],"count":24},{"id":"gtfo:zsoelim","name":"zsoelim","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zsoelim/"],"count":3},{"id":"gtfo:zypper","name":"zypper","source":"GTFOBins","platform":["Linux"],"aliases":[],"references":["https://gtfobins.github.io/gtfobins/zypper/"],"count":4},{"id":"lolbas:addinutil-exe","name":"AddinUtil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddinUtil.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddinUtil.exe","C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\AddInUtil.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\AddInUtil.exe"],"author":"Michael McKinley @MckinleyMike","created":"2023-10-05T00:00:00.000Z","contributors":["Michael McKinley @MckinleyMike","Tony Latteri @TheLatteri"],"references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html","https://lolbas-project.github.io/lolbas/Binaries/AddinUtil/"],"count":1},{"id":"lolbas:appinstaller-exe","name":"AppInstaller.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.11.2521.0_x64__8wekyb3d8bbwe\\AppInstaller.exe"],"author":"Wade Hickey","created":"2020-12-02T00:00:00.000Z","contributors":["Wade Hickey @notwhickey"],"references":["https://twitter.com/notwhickey/status/1333900137232523264","https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/"],"count":1},{"id":"lolbas:applaunch-exe","name":"Applaunch.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Applaunch.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Applaunch.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Applaunch.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Applaunch.exe"],"author":"Nathan Sawyer","created":"2026-08-08T00:00:00.000Z","contributors":["Nathan Sawyer"],"references":["https://nathan2.com/posts/clicktools","https://learn.microsoft.com/en-us/visualstudio/deployment/clickonce-security-and-deployment","https://web.archive.org/web/20060913192623/http://blogs.msdn.com/shawnfa/archive/2005/11/30/498610.aspx","https://lolbas-project.github.io/lolbas/Binaries/Applaunch/"],"count":1},{"id":"lolbas:aspnet-compiler-exe","name":"Aspnet_Compiler.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_compiler.exe","c:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\aspnet_compiler.exe"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["cpl @cpl3h"],"references":["https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/","https://docs.microsoft.com/en-us/dotnet/api/system.web.compilation.buildprovider.generatecode?view=netframework-4.8","https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/"],"count":1},{"id":"lolbas:at-exe","name":"At.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\WINDOWS\\System32\\At.exe","C:\\WINDOWS\\SysWOW64\\At.exe"],"author":"Freddie Barr-Smith","created":"2019-09-20T00:00:00.000Z","contributors":["Freddie Barr-Smith","Riccardo Spolaor","Mariano Graziano","Xabier Ugarte-Pedrero"],"references":["https://freddiebarrsmith.com/at.txt","https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_windows.html","https://www.secureworks.com/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems","https://lolbas-project.github.io/lolbas/Binaries/At/"],"count":1},{"id":"lolbas:atbroker-exe","name":"Atbroker.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Atbroker.exe","C:\\Windows\\SysWOW64\\Atbroker.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Adam @hexacorn"],"references":["http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/","https://lolbas-project.github.io/lolbas/Binaries/Atbroker/"],"count":1},{"id":"lolbas:bash-exe","name":"Bash.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\bash.exe","C:\\Windows\\SysWOW64\\bash.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Alex Ionescu @aionescu","Asif Matadar @d1r4c","Liran Ravich, CardinalOps"],"references":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules","https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/","https://lolbas-project.github.io/lolbas/Binaries/Bash/"],"count":5},{"id":"lolbas:bitsadmin-exe","name":"Bitsadmin.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\bitsadmin.exe","C:\\Windows\\SysWOW64\\bitsadmin.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Rob Fuller @mubix","Chris Gates @carnal0wnage","Oddvar Moe @oddvarmoe"],"references":["https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679","https://www.youtube.com/watch?v=_8xJaaQlpBo","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://www.soc-labs.top/en/detections/100","https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/"],"count":4},{"id":"lolbas:certoc-exe","name":"CertOC.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\certoc.exe","c:\\windows\\syswow64\\certoc.exe"],"author":"Ensar Samil","created":"2021-10-07T00:00:00.000Z","contributors":["Ensar Samil @sblmsrsn"],"references":["https://twitter.com/sblmsrsn/status/1445758411803480072?s=20","https://twitter.com/sblmsrsn/status/1452941226198671363?s=20","https://lolbas-project.github.io/lolbas/Binaries/CertOC/"],"count":2},{"id":"lolbas:certreq-exe","name":"CertReq.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\certreq.exe","C:\\Windows\\SysWOW64\\certreq.exe"],"author":"David Middlehurst","created":"2020-07-07T00:00:00.000Z","contributors":["David Middlehurst @dtmsecurity"],"references":["https://dtm.uk/certreq","https://lolbas-project.github.io/lolbas/Binaries/CertReq/"],"count":2},{"id":"lolbas:certutil-exe","name":"Certutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\certutil.exe","C:\\Windows\\SysWOW64\\certutil.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Graeber @mattifestation","Moriarty @Moriarty_Meng","egre55 @egre55","Lior Adar","Adam @hexacorn","SomeTestLeper @SomeTestLeper"],"references":["https://twitter.com/Moriarty_Meng/status/984380793383370752","https://twitter.com/mattifestation/status/620107926288515072","https://twitter.com/egre55/status/1087685529016193025","https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/","https://lolbas-project.github.io/lolbas/Binaries/Certutil/"],"count":7},{"id":"lolbas:change-exe","name":"Change.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\change.exe","c:\\windows\\syswow64\\change.exe"],"author":"Idan Lerman","created":"2025-07-31T00:00:00.000Z","contributors":["Idan Lerman @IdanLerman"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Change/"],"count":1},{"id":"lolbas:cipher-exe","name":"Cipher.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\cipher.exe","c:\\windows\\syswow64\\cipher.exe"],"author":"Adetutu Ogunsowo","created":"2024-11-22T00:00:00.000Z","contributors":["Ade Ogunsowo @i_am_tutu","Alexander Sennhauser @conitrade"],"references":["https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/","https://lolbas-project.github.io/lolbas/Binaries/Cipher/"],"count":2},{"id":"lolbas:cmd-exe","name":"Cmd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\cmd.exe","C:\\Windows\\SysWOW64\\cmd.exe"],"author":"Ye Yint Min Thu Htut","created":"2019-06-26T00:00:00.000Z","contributors":["r0lan @yeyint_mth","Mr.0range @mr_0rng"],"references":["https://twitter.com/yeyint_mth/status/1143824979139579904","https://twitter.com/Mr_0rng/status/1601408154780446721","https://medium.com/@mr-0range/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/type","https://lolbas-project.github.io/lolbas/Binaries/Cmd/"],"count":4},{"id":"lolbas:cmdkey-exe","name":"Cmdkey.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\cmdkey.exe","C:\\Windows\\SysWOW64\\cmdkey.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":[],"references":["https://web.archive.org/web/20230202122017/https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation","https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey","https://lolbas-project.github.io/lolbas/Binaries/Cmdkey/"],"count":1},{"id":"lolbas:cmdl32-exe","name":"cmdl32.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\cmdl32.exe","C:\\Windows\\SysWOW64\\cmdl32.exe"],"author":"Elliot Killick","created":"2021-08-26T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick"],"references":["https://github.com/LOLBAS-Project/LOLBAS/pull/151","https://twitter.com/ElliotKillick/status/1455897435063074824","https://elliotonsecurity.com/living-off-the-land-reverse-engineering-methodology-plus-tips-and-tricks-cmdl32-case-study/","https://lolbas-project.github.io/lolbas/Binaries/cmdl32/"],"count":1},{"id":"lolbas:cmstp-exe","name":"Cmstp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\cmstp.exe","C:\\Windows\\SysWOW64\\cmstp.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe","Nick Tyrer @NickTyrer","Naor Evgi @ghosts621"],"references":["https://twitter.com/NickTyrer/status/958450014111633408","https://gist.github.com/NickTyrer/bbd10d20a5bb78f64a9d13f399ea0f80","https://gist.github.com/api0cradle/cf36fd40fa991c3a6f7755d1810cc61e","https://oddvar.moe/2017/08/15/research-on-cmstp-exe/","https://gist.githubusercontent.com/tylerapplebaum/ae8cb38ed8314518d95b2e32a6f0d3f1/raw/3127ba7453a6f6d294cd422386cae1a5a2791d71/UACBypassCMSTP.ps1","https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmstp","https://gist.github.com/ghosts621/ea8ad5b8a0904dd40b33f01f0e8285dc","https://lolbas-project.github.io/lolbas/Binaries/Cmstp/"],"count":3},{"id":"lolbas:colorcpl-exe","name":"Colorcpl.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\colorcpl.exe","C:\\Windows\\SysWOW64\\colorcpl.exe"],"author":"Arjan Onwezen","created":"2023-06-26T00:00:00.000Z","contributors":["eral4m @eral4m"],"references":["https://twitter.com/eral4m/status/1480468728324231172","https://lolbas-project.github.io/lolbas/Binaries/Colorcpl/"],"count":1},{"id":"lolbas:computerdefaults-exe","name":"ComputerDefaults.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\ComputerDefaults.exe","C:\\Windows\\SysWOW64\\ComputerDefaults.exe"],"author":"Eron Clarke","created":"2024-09-24T00:00:00.000Z","contributors":["Eron Clarke"],"references":["https://gist.github.com/havoc3-3/812547525107bd138a1a839118a3a44b","https://lolbas-project.github.io/lolbas/Binaries/ComputerDefaults/"],"count":1},{"id":"lolbas:configsecuritypolicy-exe","name":"ConfigSecurityPolicy.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe","C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\ConfigSecurityPolicy.exe"],"author":"Ialle Teixeira","created":"2020-09-04T00:00:00.000Z","contributors":["Ialle Teixeira @NtSetDefault","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://docs.microsoft.com/en-US/mem/configmgr/comanage/how-to-switch-workloads","https://docs.microsoft.com/en-US/mem/configmgr/comanage/workloads","https://docs.microsoft.com/en-US/mem/configmgr/comanage/how-to-monitor","https://twitter.com/NtSetDefault/status/1302589153570365440?s=20","https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/"],"count":2},{"id":"lolbas:conhost-exe","name":"Conhost.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\conhost.exe"],"author":"Wietze Beukema","created":"2022-04-05T00:00:00.000Z","contributors":["Adam @hexacorn","Wietze @wietze"],"references":["https://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/","https://twitter.com/Wietze/status/1511397781159751680","https://twitter.com/embee_research/status/1559410767564181504","https://twitter.com/ankit_anubhav/status/1561683123816972288","https://lolbas-project.github.io/lolbas/Binaries/Conhost/"],"count":2},{"id":"lolbas:control-exe","name":"Control.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\control.exe","C:\\Windows\\SysWOW64\\control.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://pentestlab.blog/2017/05/24/applocker-bypass-control-panel/","https://www.contextis.com/resources/blog/applocker-bypass-registry-key-manipulation/","https://twitter.com/bohops/status/955659561008017409","https://docs.microsoft.com/en-us/windows/desktop/shell/executing-control-panel-items","https://bohops.com/2018/01/23/loading-alternate-data-stream-ads-dll-cpl-binaries-to-bypass-applocker/","https://lolbas-project.github.io/lolbas/Binaries/Control/"],"count":2},{"id":"lolbas:csc-exe","name":"Csc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Csc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Csc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\csc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\csc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\csc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\csc.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":[],"references":["https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/","https://lolbas-project.github.io/lolbas/Binaries/Csc/"],"count":2},{"id":"lolbas:cscript-exe","name":"Cscript.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\cscript.exe","C:\\Windows\\SysWOW64\\cscript.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/","https://lolbas-project.github.io/lolbas/Binaries/Cscript/"],"count":1},{"id":"lolbas:customshellhost-exe","name":"CustomShellHost.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\CustomShellHost.exe"],"author":"Wietze Beukema","created":"2021-11-14T00:00:00.000Z","contributors":["John Carroll @YoSignals"],"references":["https://twitter.com/YoSignals/status/1381353520088113154","https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher","https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/"],"count":1},{"id":"lolbas:datasvcutil-exe","name":"DataSvcUtil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\DataSvcUtil.exe"],"author":"Ialle Teixeira","created":"2020-12-01T00:00:00.000Z","contributors":["Ialle Teixeira @NtSetDefault"],"references":["https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe","https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services","https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services","https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/"],"count":1},{"id":"lolbas:desktopimgdownldr-exe","name":"Desktopimgdownldr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\desktopimgdownldr.exe"],"author":"Gal Kristal","created":"2020-06-28T00:00:00.000Z","contributors":["Gal Kristal @gal_kristal"],"references":["https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/","https://lolbas-project.github.io/lolbas/Binaries/Desktopimgdownldr/"],"count":1},{"id":"lolbas:devicecredentialdeployment-exe","name":"DeviceCredentialDeployment.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\DeviceCredentialDeployment.exe"],"author":"Elliot Killick","created":"2021-08-16T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick"],"references":["https://lolbas-project.github.io/lolbas/Binaries/DeviceCredentialDeployment/"],"count":1},{"id":"lolbas:dfsvc-exe","name":"Dfsvc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Dfsvc.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf","https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe","https://lolbas-project.github.io/lolbas/Binaries/Dfsvc/"],"count":1},{"id":"lolbas:diantz-exe","name":"Diantz.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\diantz.exe","c:\\windows\\syswow64\\diantz.exe"],"author":"Tamir Yehuda","created":"2020-08-08T00:00:00.000Z","contributors":["Tamir Yehuda @tim8288","Hai Vaknin @vakninhai"],"references":["https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz","https://ss64.com/nt/makecab-directives.html","https://lolbas-project.github.io/lolbas/Binaries/Diantz/"],"count":3},{"id":"lolbas:diskshadow-exe","name":"Diskshadow.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\diskshadow.exe","C:\\Windows\\SysWOW64\\diskshadow.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://lolbas-project.github.io/lolbas/Binaries/Diskshadow/"],"count":2},{"id":"lolbas:dnscmd-exe","name":"Dnscmd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Dnscmd.exe","C:\\Windows\\SysWOW64\\Dnscmd.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Shay Ber","Dimitrios Slamaris @dim0x69","Nikhil SamratAshok @nikhil_mitt"],"references":["https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83","https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html","https://github.com/dim0x69/dns-exe-persistance/tree/master/dns-plugindll-vcpp","https://twitter.com/Hexacorn/status/994000792628719618","http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html","https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/"],"count":1},{"id":"lolbas:esentutl-exe","name":"Esentutl.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\esentutl.exe","C:\\Windows\\SysWOW64\\esentutl.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["egre55 @egre55","Mike Cary @grayfold3d"],"references":["https://twitter.com/egre55/status/985994639202283520","https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/","https://twitter.com/bohops/status/1094810861095534592","https://lolbas-project.github.io/lolbas/Binaries/Esentutl/"],"count":6},{"id":"lolbas:eudcedit-exe","name":"Eudcedit.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\eudcedit.exe","c:\\windows\\syswow64\\eudcedit.exe"],"author":"Matan Bahar","created":"2025-08-07T00:00:00.000Z","contributors":["Matan Bahar @Bl4ckShad3"],"references":["https://medium.com/@matanb707/windows-fonts-exploitation-in-2025-bypassing-uac-with-eudcedit-915599705639","https://lolbas-project.github.io/lolbas/Binaries/Eudcedit/"],"count":1},{"id":"lolbas:eventvwr-exe","name":"Eventvwr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\eventvwr.exe","C:\\Windows\\SysWOW64\\eventvwr.exe"],"author":"Jacob Gajek","created":"2018-11-01T00:00:00.000Z","contributors":["Matt Nelson @enigma0x3","Matt Graeber @mattifestation","Orange Tsai @orange_8361"],"references":["https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/","https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-EventVwrBypass.ps1","https://twitter.com/orange_8361/status/1518970259868626944","https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/"],"count":2},{"id":"lolbas:expand-exe","name":"Expand.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Expand.exe","C:\\Windows\\SysWOW64\\Expand.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Rahmat Nurfauzi @infosecn1nja","Oddvar Moe @oddvarmoe"],"references":["https://twitter.com/infosecn1nja/status/986628482858807297","https://twitter.com/Oddvarmoe/status/986709068759949319","https://lolbas-project.github.io/lolbas/Binaries/Expand/"],"count":3},{"id":"lolbas:explorer-exe","name":"Explorer.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\explorer.exe","C:\\Windows\\SysWOW64\\explorer.exe"],"author":"Jai Minton","created":"2020-06-24T00:00:00.000Z","contributors":["Jai Minton @CyberRaiju","Jimmy @bohops"],"references":["https://twitter.com/CyberRaiju/status/1273597319322058752?s=20","https://twitter.com/bohops/status/1276356245541335048","https://twitter.com/bohops/status/986984122563391488","https://lolbas-project.github.io/lolbas/Binaries/Explorer/"],"count":2},{"id":"lolbas:extexport-exe","name":"Extexport.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Internet Explorer\\Extexport.exe","C:\\Program Files (x86)\\Internet Explorer\\Extexport.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Adam @hexacorn"],"references":["http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/","https://lolbas-project.github.io/lolbas/Binaries/Extexport/"],"count":1},{"id":"lolbas:extrac32-exe","name":"Extrac32.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\extrac32.exe","C:\\Windows\\SysWOW64\\extrac32.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["egre55 @egre55","Oddvar Moe @oddvarmoe","Hai Vaknin(Lux @VakninHai","Tamir Yehuda @tim8288"],"references":["https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://twitter.com/egre55/status/985994639202283520","https://lolbas-project.github.io/lolbas/Binaries/Extrac32/"],"count":4},{"id":"lolbas:findstr-exe","name":"Findstr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\findstr.exe","C:\\Windows\\SysWOW64\\findstr.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://lolbas-project.github.io/lolbas/Binaries/Findstr/"],"count":4},{"id":"lolbas:finger-exe","name":"Finger.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\finger.exe","c:\\windows\\syswow64\\finger.exe"],"author":"Ruben Revuelta","created":"2021-08-30T00:00:00.000Z","contributors":["Ruben Revuelta (MAPFRE CERT) @rubn_RB","Jose A. Jimenez (MAPFRE CERT) @Ocelotty6669","Malwrologist @DissectMalware"],"references":["https://twitter.com/DissectMalware/status/997340270273409024","https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff961508(v=ws.11)","https://lolbas-project.github.io/lolbas/Binaries/Finger/"],"count":1},{"id":"lolbas:fltmc-exe","name":"fltMC.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\fltMC.exe"],"author":"John Lambert","created":"2021-09-18T00:00:00.000Z","contributors":["Carlos Perez @Carlos_Perez"],"references":["https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon","https://lolbas-project.github.io/lolbas/Binaries/fltMC/"],"count":1},{"id":"lolbas:forfiles-exe","name":"Forfiles.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\forfiles.exe","C:\\Windows\\SysWOW64\\forfiles.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Eric @vector_sec","Oddvar Moe @oddvarmoe"],"references":["https://twitter.com/vector_sec/status/896049052642533376","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/","https://lolbas-project.github.io/lolbas/Binaries/Forfiles/"],"count":2},{"id":"lolbas:fsutil-exe","name":"Fsutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\fsutil.exe","C:\\Windows\\SysWOW64\\fsutil.exe"],"author":"Elliot Killick","created":"2021-08-16T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick","Jimmy @bohops","Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1720724516324704404","https://lolbas-project.github.io/lolbas/Binaries/Fsutil/"],"count":3},{"id":"lolbas:ftp-exe","name":"Ftp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\ftp.exe","C:\\Windows\\SysWOW64\\ftp.exe"],"author":"Oddvar Moe","created":"2018-12-10T00:00:00.000Z","contributors":["Casey Smith @subtee","BennyHusted","Amit Serper @0xAmit"],"references":["https://twitter.com/0xAmit/status/1070063130636640256","https://medium.com/@0xamit/lets-talk-about-security-research-discoveries-and-proper-discussion-etiquette-on-twitter-10f9be6d1939","https://ss64.com/nt/ftp.html","https://www.asafety.fr/vuln-exploit-poc/windows-dos-powershell-upload-de-fichier-en-ligne-de-commande-one-liner/","https://lolbas-project.github.io/lolbas/Binaries/Ftp/"],"count":2},{"id":"lolbas:gpscript-exe","name":"Gpscript.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\gpscript.exe","C:\\Windows\\SysWOW64\\gpscript.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/","https://lolbas-project.github.io/lolbas/Binaries/Gpscript/"],"count":2},{"id":"lolbas:hh-exe","name":"Hh.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\hh.exe","C:\\Windows\\SysWOW64\\hh.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/","https://lolbas-project.github.io/lolbas/Binaries/Hh/"],"count":3},{"id":"lolbas:imewdbld-exe","name":"IMEWDBLD.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\IME\\SHARED\\IMEWDBLD.exe"],"author":"Wade Hickey","created":"2020-03-05T00:00:00.000Z","contributors":["Wade Hickey @notwhickey"],"references":["https://twitter.com/notwhickey/status/1367493406835040265","https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/"],"count":1},{"id":"lolbas:ie4uinit-exe","name":"Ie4uinit.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\ie4uinit.exe","c:\\windows\\sysWOW64\\ie4uinit.exe","c:\\windows\\system32\\ieuinit.inf","c:\\windows\\sysWOW64\\ieuinit.inf"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/","https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/"],"count":1},{"id":"lolbas:iediagcmd-exe","name":"iediagcmd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Internet Explorer\\iediagcmd.exe"],"author":"manasmbellani","created":"2022-03-29T00:00:00.000Z","contributors":["Adam @hexacorn"],"references":["https://twitter.com/Hexacorn/status/1507516393859731456","https://lolbas-project.github.io/lolbas/Binaries/iediagcmd/"],"count":1},{"id":"lolbas:ieexec-exe","name":"Ieexec.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ieexec.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ieexec.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/","https://lolbas-project.github.io/lolbas/Binaries/Ieexec/"],"count":2},{"id":"lolbas:ilasm-exe","name":"Ilasm.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ilasm.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ilasm.exe"],"author":"Hai vaknin (lux)","created":"2020-03-17T00:00:00.000Z","contributors":["Hai Vaknin(Lux) @VakninHai","Lior Adar"],"references":["https://github.com/LuxNoBulIshit/BeforeCompileBy-ilasm/blob/master/hello_world.txt","https://lolbas-project.github.io/lolbas/Binaries/Ilasm/"],"count":2},{"id":"lolbas:infdefaultinstall-exe","name":"Infdefaultinstall.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Infdefaultinstall.exe","C:\\Windows\\SysWOW64\\Infdefaultinstall.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Kyle Hanslovan @kylehanslovan"],"references":["https://twitter.com/KyleHanslovan/status/911997635455852544","https://blog.conscioushacker.io/index.php/2017/10/25/evading-microsofts-autoruns/","https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/","https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/"],"count":1},{"id":"lolbas:installutil-exe","name":"Installutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\InstallUtil.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/","https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md","https://www.blackhillsinfosec.com/powershell-without-powershell-how-to-bypass-application-whitelisting-environment-restrictions-av/","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool","https://lolbas-project.github.io/lolbas/Binaries/Installutil/"],"count":3},{"id":"lolbas:iscsicpl-exe","name":"iscsicpl.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\iscsicpl.exe","c:\\windows\\syswow64\\iscsicpl.exe"],"author":"Ekitji","created":"2025-08-17T00:00:00.000Z","contributors":["hacker.house","Ekitji @eki_erk"],"references":["https://learn.microsoft.com/en-us/windows-server/storage/iscsi/iscsi-initiator-portal","https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC","https://lolbas-project.github.io/lolbas/Binaries/iscsicpl/"],"count":2},{"id":"lolbas:jsc-exe","name":"Jsc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Jsc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Jsc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Jsc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Jsc.exe"],"author":"Oddvar Moe","created":"2019-05-31T00:00:00.000Z","contributors":["Malwrologist @DissectMalware"],"references":["https://twitter.com/DissectMalware/status/998797808907046913","https://www.phpied.com/make-your-javascript-a-windows-exe/","https://lolbas-project.github.io/lolbas/Binaries/Jsc/"],"count":2},{"id":"lolbas:ldifde-exe","name":"Ldifde.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\ldifde.exe","c:\\windows\\syswow64\\ldifde.exe"],"author":"Grzegorz Tworek","created":"2022-08-31T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1564968845726580736","https://lolbas-project.github.io/lolbas/Binaries/Ldifde/"],"count":1},{"id":"lolbas:makecab-exe","name":"Makecab.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\makecab.exe","C:\\Windows\\SysWOW64\\makecab.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://ss64.com/nt/makecab-directives.html","https://www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf","https://learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application","https://lolbas-project.github.io/lolbas/Binaries/Makecab/"],"count":4},{"id":"lolbas:mavinject-exe","name":"Mavinject.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\mavinject.exe","C:\\Windows\\SysWOW64\\mavinject.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Giuseppe N3mes1s @gN3mes1s","Oddvar Moe @oddvarmoe"],"references":["https://twitter.com/gN3mes1s/status/941315826107510784","https://twitter.com/Hexcorn/status/776122138063409152","https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/","https://lolbas-project.github.io/lolbas/Binaries/Mavinject/"],"count":2},{"id":"lolbas:microsoft-workflow-compiler-exe","name":"Microsoft.Workflow.Compiler.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.Net\\Framework64\\v4.0.30319\\Microsoft.Workflow.Compiler.exe"],"author":"Conor Richard","created":"2018-10-22T00:00:00.000Z","contributors":["Matt Graeber @mattifestation","John Bergbom @BergbomJohn","FortyNorth Security @FortyNorthSec","Bank Security @Bank_Security"],"references":["https://twitter.com/mattifestation/status/1030445200475185154","https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb","https://gist.github.com/mattifestation/3e28d391adbd7fe3e0c722a107a25aba#file-workflowcompilerdetectiontests-ps1","https://gist.github.com/mattifestation/7ba8fc8f724600a9f525714c9cf767fd#file-createcompilerinputxml-ps1","https://www.forcepoint.com/blog/security-labs/using-c-post-powershell-attacks","https://www.fortynorthsecurity.com/microsoft-workflow-compiler-exe-veil-and-cobalt-strike/","https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15","https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"],"count":3},{"id":"lolbas:mmc-exe","name":"Mmc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\mmc.exe","C:\\Windows\\SysWOW64\\mmc.exe"],"author":"@bohops","created":"2018-12-04T00:00:00.000Z","contributors":["Jimmy @bohops","clem @clavoillotte","Fredrik H. Brathen"],"references":["https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/","https://offsec.almond.consulting/UAC-bypass-dotnet.html","https://www.youtube.com/watch?v=LFgZOTmhzeA","https://lolbas-project.github.io/lolbas/Binaries/Mmc/"],"count":3},{"id":"lolbas:mofcomp-exe","name":"Mofcomp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wbem\\mofcomp.exe","C:\\Windows\\SysWOW64\\wbem\\mofcomp.exe"],"author":"Daniel Gott","created":"2022-07-19T00:00:00.000Z","contributors":["Daniel Gott @gott_cyber","The DFIR Report @TheDFIRReport","Nasreddine Bencherchali @nas_bench"],"references":["https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp","https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-","https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/","https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/","https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96","https://lolbas-project.github.io/lolbas/Binaries/Mofcomp/"],"count":1},{"id":"lolbas:mpcmdrun-exe","name":"MpCmdRun.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.4-0\\MpCmdRun.exe","C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.7-0\\MpCmdRun.exe","C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2008.9-0\\MpCmdRun.exe","C:\\Program Files\\Windows Defender\\MpCmdRun.exe","C:\\Program Files (x86)\\Windows Defender\\MpCmdRun.exe","C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.23110.3-0\\X86\\MpCmdRun.exe"],"author":"Oddvar Moe","created":"2020-03-20T00:00:00.000Z","contributors":["Askar @mohammadaskar2","Oddvar Moe @oddvarmoe","RichRumble","Cedric @th3c3dr1c"],"references":["https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus","https://twitter.com/mohammadaskar2/status/1301263551638761477","https://twitter.com/Oddvarmoe/status/1301444858910052352","https://twitter.com/NotMedic/status/1301506813242867720","https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/"],"count":3},{"id":"lolbas:msbuild-exe","name":"Msbuild.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Msbuild.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Msbuild.exe","C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\Msbuild.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\Msbuild.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Msbuild.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Msbuild.exe","C:\\Program Files (x86)\\MSBuild\\14.0\\bin\\MSBuild.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Cn33liz @Cneelis","Jimmy @bohops"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127/T1127.md","https://github.com/Cn33liz/MSBuildShell","https://pentestlab.blog/2017/05/29/applocker-bypass-msbuild/","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://gist.github.com/bohops/4ffc43a281e87d108875f07614324191","https://github.com/LOLBAS-Project/LOLBAS/issues/165","https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-response-files","https://www.daveaglick.com/posts/msbuild-loggers-and-logging-events","https://lolbas-project.github.io/lolbas/Binaries/Msbuild/"],"count":5},{"id":"lolbas:msconfig-exe","name":"Msconfig.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\msconfig.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/991314564896690177","https://lolbas-project.github.io/lolbas/Binaries/Msconfig/"],"count":1},{"id":"lolbas:msdt-exe","name":"Msdt.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Msdt.exe","C:\\Windows\\SysWOW64\\Msdt.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Nasreddine Bencherchali @nas_bench"],"references":["https://web.archive.org/web/20160322142537/https://cybersyndicates.com/2015/10/a-no-bull-guide-to-malicious-windows-trouble-shooting-packs-and-application-whitelist-bypass/","https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/","https://twitter.com/harr0ey/status/991338229952598016","https://twitter.com/nas_bench/status/1531944240271568896","https://lolbas-project.github.io/lolbas/Binaries/Msdt/"],"count":3},{"id":"lolbas:msedge-exe","name":"Msedge.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe","c:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"],"author":"mr.d0x","created":"2022-01-20T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://twitter.com/mrd0x/status/1478116126005641220","https://twitter.com/mrd0x/status/1478234484881436672","https://lolbas-project.github.io/lolbas/Binaries/Msedge/"],"count":3},{"id":"lolbas:mshta-exe","name":"Mshta.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\mshta.exe","C:\\Windows\\SysWOW64\\mshta.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Oddvar Moe @oddvarmoe","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_4","https://github.com/redcanaryco/atomic-red-team/blob/master/Windows/Payloads/mshta.sct","https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/","https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/","https://lolbas-project.github.io/lolbas/Binaries/Mshta/"],"count":5},{"id":"lolbas:msiexec-exe","name":"Msiexec.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\msiexec.exe","C:\\Windows\\SysWOW64\\msiexec.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["netbiosX @netbiosX","Philip Tsukerman @PhilipTsukerman"],"references":["https://pentestlab.blog/2017/06/16/applocker-bypass-msiexec/","https://twitter.com/PhilipTsukerman/status/992021361106268161","https://badoption.eu/blog/2023/10/03/MSIFortune.html","https://lolbas-project.github.io/lolbas/Binaries/Msiexec/"],"count":5},{"id":"lolbas:msoxmled-exe","name":"msoxmled.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\msoxmled.exe","C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\msoxmled.exe"],"author":"Bogac Kaya","created":"2025-08-22T00:00:00.000Z","contributors":["Bogac Kaya @bogackayaa","Furkan Celik @frknclk034"],"references":["https://learn.microsoft.com/en-us/answers/questions/4805030/where-is-msoxmled-exe-for-office-professional-2013","https://lolbas-project.github.io/lolbas/Binaries/msoxmled/"],"count":1},{"id":"lolbas:netsh-exe","name":"Netsh.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\WINDOWS\\System32\\Netsh.exe","C:\\WINDOWS\\SysWOW64\\Netsh.exe"],"author":"Freddie Barr-Smith","created":"2019-12-24T00:00:00.000Z","contributors":["Freddie Barr-Smith","Riccardo Spolaor","Mariano Graziano","Xabier Ugarte-Pedrero"],"references":["https://freddiebarrsmith.com/trix/trix.html","https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html","https://liberty-shell.com/sec/2018/07/28/netshlep/","https://lolbas-project.github.io/lolbas/Binaries/Netsh/"],"count":1},{"id":"lolbas:ngen-exe","name":"Ngen.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ngen.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\ngen.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.exe"],"author":"Avihay Eldad","created":"2024-02-19T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Ngen/"],"count":1},{"id":"lolbas:odbcconf-exe","name":"Odbcconf.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\odbcconf.exe","C:\\Windows\\SysWOW64\\odbcconf.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Adam @Hexacorn"],"references":["https://gist.github.com/NickTyrer/6ef02ce3fd623483137b45f65017352b","https://github.com/woanware/application-restriction-bypasses","https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/","https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/"],"count":3},{"id":"lolbas:offlinescannershell-exe","name":"OfflineScannerShell.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Windows Defender\\Offline\\OfflineScannerShell.exe"],"author":"Elliot Killick","created":"2021-08-16T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick"],"references":["https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/"],"count":1},{"id":"lolbas:onedrivestandaloneupdater-exe","name":"OneDriveStandaloneUpdater.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Users\\<username>\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe","C:\\Program Files\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe","C:\\Program Files (x86)\\Microsoft OneDrive\\OneDriveStandaloneUpdater.exe"],"author":"Elliot Killick","created":"2021-08-22T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick"],"references":["https://github.com/LOLBAS-Project/LOLBAS/pull/153","https://lolbas-project.github.io/lolbas/Binaries/OneDriveStandaloneUpdater/"],"count":1},{"id":"lolbas:pcalua-exe","name":"Pcalua.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\pcalua.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Kyle Hanslovan @kylehanslovan","Fab @0rbz_"],"references":["https://twitter.com/KyleHanslovan/status/912659279806640128","https://lolbas-project.github.io/lolbas/Binaries/Pcalua/"],"count":3},{"id":"lolbas:pcwrun-exe","name":"Pcwrun.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\pcwrun.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken","Nasreddine Bencherchali @nas_bench"],"references":["https://twitter.com/pabraeken/status/991335019833708544","https://twitter.com/nas_bench/status/1535663791362519040","https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/"],"count":2},{"id":"lolbas:pktmon-exe","name":"Pktmon.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\pktmon.exe","c:\\windows\\syswow64\\pktmon.exe"],"author":"Derek Johnson","created":"2020-08-12T00:00:00.000Z","contributors":["Derek Johnson"],"references":["https://binar-x79.com/windows-10-secret-sniffer/","https://lolbas-project.github.io/lolbas/Binaries/Pktmon/"],"count":2},{"id":"lolbas:pnputil-exe","name":"Pnputil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\system32\\pnputil.exe"],"author":"Hai vaknin (lux)","created":"2020-12-25T00:00:00.000Z","contributors":["Hai Vaknin(Lux) @LuxNoBulIshit","Avihay eldad @aloneliassaf"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Pnputil/"],"count":1},{"id":"lolbas:presentationhost-exe","name":"Presentationhost.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Presentationhost.exe","C:\\Windows\\SysWOW64\\Presentationhost.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf","https://oddvar.moe/2017/12/21/applocker-case-study-how-insecure-is-it-really-part-2/","https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/"],"count":2},{"id":"lolbas:print-exe","name":"Print.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\print.exe","C:\\Windows\\SysWOW64\\print.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://twitter.com/Oddvarmoe/status/985518877076541440","https://www.youtube.com/watch?v=nPBcSP8M7KE&lc=z22fg1cbdkabdf3x404t1aokgwd2zxasf2j3rbozrswnrk0h00410","https://lolbas-project.github.io/lolbas/Binaries/Print/"],"count":3},{"id":"lolbas:printbrm-exe","name":"PrintBrm.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\spool\\tools\\PrintBrm.exe"],"author":"Elliot Killick","created":"2021-06-21T00:00:00.000Z","contributors":["Elliot Killick @elliotkillick"],"references":["https://twitter.com/elliotkillick/status/1404117015447670800","https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/"],"count":2},{"id":"lolbas:provlaunch-exe","name":"Provlaunch.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\provlaunch.exe"],"author":"Grzegorz Tworek","created":"2023-06-30T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1674399582162153472","https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/"],"count":1},{"id":"lolbas:psr-exe","name":"Psr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\psr.exe","c:\\windows\\syswow64\\psr.exe"],"author":"Leon Rodenko","created":"2020-06-27T00:00:00.000Z","contributors":["Leon Rodenko @L3m0nada"],"references":["https://social.technet.microsoft.com/wiki/contents/articles/51722.windows-problem-steps-recorder-psr-quick-and-easy-documenting-of-your-steps-and-procedures.aspx","https://lolbas-project.github.io/lolbas/Binaries/Psr/"],"count":1},{"id":"lolbas:query-exe","name":"Query.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\query.exe","c:\\windows\\syswow64\\query.exe"],"author":"Idan Lerman","created":"2025-07-31T00:00:00.000Z","contributors":["Idan Lerman @IdanLerman"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Query/"],"count":1},{"id":"lolbas:rasautou-exe","name":"Rasautou.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\rasautou.exe"],"author":"Tony Lambert","created":"2020-01-10T00:00:00.000Z","contributors":["FireEye @FireEye"],"references":["https://github.com/fireeye/DueDLLigence","https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html","https://lolbas-project.github.io/lolbas/Binaries/Rasautou/"],"count":1},{"id":"lolbas:rdrleakdiag-exe","name":"rdrleakdiag.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\rdrleakdiag.exe","c:\\Windows\\SysWOW64\\rdrleakdiag.exe"],"author":"John Dwyer","created":"2022-05-18T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1299071304805560321?s=21","https://www.pureid.io/dumping-abusing-windows-credentials-part-1/","https://github.com/LOLBAS-Project/LOLBAS/issues/84","https://lolbas-project.github.io/lolbas/Binaries/rdrleakdiag/"],"count":3},{"id":"lolbas:reg-exe","name":"Reg.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\reg.exe","C:\\Windows\\SysWOW64\\reg.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://pure.security/dumping-windows-credentials/","https://lolbas-project.github.io/lolbas/Binaries/Reg/"],"count":2},{"id":"lolbas:regasm-exe","name":"Regasm.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\regasm.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\regasm.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\regasm.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\regasm.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md","https://lolbas-project.github.io/lolbas/Binaries/Regasm/"],"count":2},{"id":"lolbas:regedit-exe","name":"Regedit.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\regedit.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://lolbas-project.github.io/lolbas/Binaries/Regedit/"],"count":2},{"id":"lolbas:regini-exe","name":"Regini.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\regini.exe","C:\\Windows\\SysWOW64\\regini.exe"],"author":"Oddvar Moe","created":"2020-07-03T00:00:00.000Z","contributors":["Eli Salem @elisalem9"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://lolbas-project.github.io/lolbas/Binaries/Regini/"],"count":1},{"id":"lolbas:register-cimprovider-exe","name":"Register-cimprovider.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\Register-cimprovider.exe","C:\\Windows\\SysWOW64\\Register-cimprovider.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Philip Tsukerman @PhilipTsukerman"],"references":["https://twitter.com/PhilipTsukerman/status/992021361106268161","https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/"],"count":1},{"id":"lolbas:regsvcs-exe","name":"Regsvcs.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\RegSvcs.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\RegSvcs.exe","C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://pentestlab.blog/2017/05/19/applocker-bypass-regasm-and-regsvcs/","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md","https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/"],"count":2},{"id":"lolbas:regsvr32-exe","name":"Regsvr32.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\regsvr32.exe","C:\\Windows\\SysWOW64\\regsvr32.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md","https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/"],"count":6},{"id":"lolbas:replace-exe","name":"Replace.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\replace.exe","C:\\Windows\\SysWOW64\\replace.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["elceef @elceef"],"references":["https://twitter.com/elceef/status/986334113941655553","https://twitter.com/elceef/status/986842299861782529","https://lolbas-project.github.io/lolbas/Binaries/Replace/"],"count":2},{"id":"lolbas:reset-exe","name":"Reset.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\reset.exe","c:\\windows\\syswow64\\reset.exe"],"author":"Matan Bahar","created":"2025-07-31T00:00:00.000Z","contributors":["Matan Bahar @Bl4ckShad3"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Reset/"],"count":1},{"id":"lolbas:rpcping-exe","name":"Rpcping.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\rpcping.exe","C:\\Windows\\SysWOW64\\rpcping.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Vincent Yiu @vysecurity","Antonio Cocomazzi @splinter_code","ap @decoder_it"],"references":["https://github.com/vysec/RedTips","https://twitter.com/vysecurity/status/974806438316072960","https://twitter.com/vysecurity/status/873181705024266241","https://twitter.com/splinter_code/status/1421144623678988298","https://lolbas-project.github.io/lolbas/Binaries/Rpcping/"],"count":2},{"id":"lolbas:rundll32-exe","name":"Rundll32.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\rundll32.exe","C:\\Windows\\SysWOW64\\rundll32.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Oddvar Moe @oddvarmoe","Jimmy @bohops","Sailay @404death","Martin Ingesen @Mrtn9"],"references":["https://pentestlab.blog/2017/05/23/applocker-bypass-rundll32/","https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_7","https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/","https://oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/","https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/","https://github.com/sailay1996/expl-bin/blob/master/obfus.md","https://github.com/sailay1996/misc-bin/blob/master/rundll32.md","https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90","https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code","https://lolbas-project.github.io/lolbas/Binaries/Rundll32/"],"count":5},{"id":"lolbas:runexehelper-exe","name":"Runexehelper.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\runexehelper.exe"],"author":"Grzegorz Tworek","created":"2022-12-13T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1206692239839289344","https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/"],"count":1},{"id":"lolbas:runonce-exe","name":"Runonce.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\runonce.exe","C:\\Windows\\SysWOW64\\runonce.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/990717080805789697","https://cmatskas.com/configure-a-runonce-task-on-windows/","https://lolbas-project.github.io/lolbas/Binaries/Runonce/"],"count":1},{"id":"lolbas:runscripthelper-exe","name":"Runscripthelper.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.15_none_c2df1bba78111118\\Runscripthelper.exe","C:\\Windows\\WinSxS\\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.16299.192_none_ad4699b571e00c4a\\Runscripthelper.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Graeber @mattifestation"],"references":["https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc","https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/"],"count":1},{"id":"lolbas:sc-exe","name":"Sc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\sc.exe","C:\\Windows\\SysWOW64\\sc.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://lolbas-project.github.io/lolbas/Binaries/Sc/"],"count":2},{"id":"lolbas:schtasks-exe","name":"Schtasks.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\schtasks.exe","c:\\windows\\syswow64\\schtasks.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":[],"references":["https://isc.sans.edu/forums/diary/Adding+Persistence+Via+Scheduled+Tasks/23633/","https://lolbas-project.github.io/lolbas/Binaries/Schtasks/"],"count":2},{"id":"lolbas:scp-exe","name":"scp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\OpenSSH\\scp.exe"],"author":"BinFault","created":"2026-06-03T00:00:00.000Z","contributors":["BinFault @binfault","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://gtfobins.org/gtfobins/scp/","https://lolbas-project.github.io/lolbas/Binaries/scp/"],"count":2},{"id":"lolbas:scriptrunner-exe","name":"Scriptrunner.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\scriptrunner.exe","C:\\Windows\\SysWOW64\\scriptrunner.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Nick Tyrer @nicktyrer"],"references":["https://twitter.com/KyleHanslovan/status/914800377580503040","https://twitter.com/NickTyrer/status/914234924655312896","https://github.com/MoooKitty/Code-Execution","https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/"],"count":2},{"id":"lolbas:setres-exe","name":"Setres.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\setres.exe"],"author":"Grzegorz Tworek","created":"2022-10-21T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet"],"references":["https://twitter.com/0gtweet/status/1583356502340870144","https://lolbas-project.github.io/lolbas/Binaries/Setres/"],"count":1},{"id":"lolbas:settingsynchost-exe","name":"SettingSyncHost.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\SettingSyncHost.exe","C:\\Windows\\SysWOW64\\SettingSyncHost.exe"],"author":"Elliot Killick","created":"2021-08-26T00:00:00.000Z","contributors":["Adam @hexacorn","Elliot Killick @elliotkillick"],"references":["https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin/","https://lolbas-project.github.io/lolbas/Binaries/SettingSyncHost/"],"count":2},{"id":"lolbas:sftp-exe","name":"Sftp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\OpenSSH\\sftp.exe"],"author":"Swachchhanda Shrawan Poudel","created":"2025-05-13T00:00:00.000Z","contributors":["Swachchhanda Shrawan Poudel @_swachchhanda_","Nir Chako (Pentera) @C_h4ck_0"],"references":["https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/","https://lolbas-project.github.io/lolbas/Binaries/Sftp/"],"count":2},{"id":"lolbas:sigverif-exe","name":"Sigverif.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\sigverif.exe","C:\\Windows\\SysWOW64\\sigverif.exe"],"author":"Moshe Kaplan","created":"2021-11-08T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet","Adam @Hexacorn"],"references":["https://twitter.com/0gtweet/status/1457676633809330184","https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/","https://lolbas-project.github.io/lolbas/Binaries/Sigverif/"],"count":1},{"id":"lolbas:ssh-exe","name":"ssh.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\OpenSSH\\ssh.exe"],"author":"Akshat Pradhan","created":"2021-11-08T00:00:00.000Z","contributors":["Akshat Pradhan","Felix Boulet","Edo Maland"],"references":["https://gtfobins.github.io/gtfobins/ssh/","https://gist.github.com/screetsec/97d90750bfb058eb0b49c5374cdc0ac9","https://lolbas-project.github.io/lolbas/Binaries/ssh/"],"count":3},{"id":"lolbas:stordiag-exe","name":"Stordiag.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\stordiag.exe","c:\\windows\\syswow64\\stordiag.exe"],"author":"Eral4m","created":"2021-10-21T00:00:00.000Z","contributors":["Eral4m @eral4m","Ekitji @eki_erk"],"references":["https://twitter.com/eral4m/status/1451112385041911809","https://lolbas-project.github.io/lolbas/Binaries/Stordiag/"],"count":2},{"id":"lolbas:syncappvpublishingserver-exe","name":"SyncAppvPublishingServer.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\SyncAppvPublishingServer.exe","C:\\Windows\\SysWOW64\\SyncAppvPublishingServer.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Nick Landers @monoxgas"],"references":["https://twitter.com/monoxgas/status/895045566090010624","https://lolbas-project.github.io/lolbas/Binaries/SyncAppvPublishingServer/"],"count":1},{"id":"lolbas:tar-exe","name":"Tar.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\tar.exe","C:\\Windows\\SysWOW64\\tar.exe"],"author":"Brian Lucero","created":"2023-01-30T00:00:00.000Z","contributors":["Brian Lucero @Cyber_Sorcery","Avester Fahimipour"],"references":["https://twitter.com/Cyber_Sorcery/status/1619819249886969856","https://lolbas-project.github.io/lolbas/Binaries/Tar/"],"count":3},{"id":"lolbas:ttdinject-exe","name":"Ttdinject.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\ttdinject.exe","C:\\Windows\\Syswow64\\ttdinject.exe"],"author":"Maxime Nadeau","created":"2020-05-12T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe","Maxime Nadeau @m_nad0"],"references":["https://twitter.com/Oddvarmoe/status/1196333160470138880","https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/"],"count":2},{"id":"lolbas:tttracer-exe","name":"Tttracer.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\tttracer.exe","C:\\Windows\\SysWOW64\\tttracer.exe"],"author":"Oddvar Moe","created":"2019-11-05T00:00:00.000Z","contributors":["Onur Ulusoy @oulusoyum","Matt Graeber @mattifestation"],"references":["https://twitter.com/oulusoyum/status/1191329746069655553","https://twitter.com/mattifestation/status/1196390321783025666","https://lists.samba.org/archive/cifs-protocol/2016-April/002877.html","https://lolbas-project.github.io/lolbas/Binaries/Tttracer/"],"count":2},{"id":"lolbas:unregmp2-exe","name":"Unregmp2.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\unregmp2.exe","C:\\Windows\\SysWOW64\\unregmp2.exe"],"author":"Wade Hickey","created":"2021-12-06T00:00:00.000Z","contributors":["Wade Hickey @notwhickey"],"references":["https://twitter.com/notwhickey/status/1466588365336293385","https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/"],"count":1},{"id":"lolbas:vbc-exe","name":"vbc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v3.5\\vbc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\vbc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v3.5\\vbc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\vbc.exe"],"author":"Lior Adar","created":"2020-02-27T00:00:00.000Z","contributors":["Lior Adar","Hai Vaknin(Lux)"],"references":["https://lolbas-project.github.io/lolbas/Binaries/vbc/"],"count":2},{"id":"lolbas:verclsid-exe","name":"Verclsid.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\verclsid.exe","C:\\Windows\\SysWOW64\\verclsid.exe"],"author":"@bohops","created":"2018-12-04T00:00:00.000Z","contributors":["Nick Tyrer @NickTyrer"],"references":["https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5","https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/","https://lolbas-project.github.io/lolbas/Binaries/Verclsid/"],"count":1},{"id":"lolbas:vssadmin-exe","name":"Vssadmin.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\vssadmin.exe"],"author":"mmadersbacher","created":"2026-08-16T00:00:00.000Z","contributors":[],"references":["https://attack.mitre.org/techniques/T1490/","https://github.com/Neo23x0/Raccine","https://lolbas-project.github.io/lolbas/Binaries/Vssadmin/"],"count":1},{"id":"lolbas:wab-exe","name":"Wab.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\Windows Mail\\wab.exe","C:\\Program Files (x86)\\Windows Mail\\wab.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Adam @Hexacorn"],"references":["https://twitter.com/Hexacorn/status/991447379864932352","http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/","https://lolbas-project.github.io/lolbas/Binaries/Wab/"],"count":1},{"id":"lolbas:wbadmin-exe","name":"wbadmin.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wbadmin.exe"],"author":"Chris Eastwood","created":"2024-04-05T00:00:00.000Z","contributors":[],"references":["https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960","https://lolbas-project.github.io/lolbas/Binaries/wbadmin/"],"count":2},{"id":"lolbas:wbemtest-exe","name":"wbemtest.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\wbem\\wbemtest.exe"],"author":"saulpanders","created":"2025-04-22T00:00:00.000Z","contributors":["Paul Sanders @saulpanders"],"references":["https://saulpanders.github.io/2025/01/20/lolbas-wbemtest.html","https://lolbas-project.github.io/lolbas/Binaries/wbemtest/"],"count":1},{"id":"lolbas:winget-exe","name":"winget.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Users\\user\\AppData\\Local\\Microsoft\\WindowsApps\\winget.exe"],"author":"Paul Sanders","created":"2022-01-03T00:00:00.000Z","contributors":["Paul @saulpanders","Konrad 'unrooted' Klawikowski","Fredrik H. Brathen"],"references":["https://saulpanders.github.io/2022/01/02/New-Year-New-LOLBAS.html","https://docs.microsoft.com/en-us/windows/package-manager/winget/#production-recommended","https://www.youtube.com/watch?v=zuL7x4Wltto","https://lolbas-project.github.io/lolbas/Binaries/winget/"],"count":3},{"id":"lolbas:wlrmdr-exe","name":"Wlrmdr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\wlrmdr.exe"],"author":"Moshe Kaplan","created":"2022-02-16T00:00:00.000Z","contributors":["Grzegorz Tworek @0gtweet","Oddvar Moe @Oddvarmoe","Freddy @falsneg"],"references":["https://twitter.com/0gtweet/status/1493963591745220608","https://twitter.com/Oddvarmoe/status/927437787242090496","https://twitter.com/falsneg/status/1461625526640992260","https://docs.microsoft.com/en-us/windows/win32/api/shellapi/ns-shellapi-notifyicondataw","https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/"],"count":1},{"id":"lolbas:wmic-exe","name":"Wmic.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wbem\\wmic.exe","C:\\Windows\\SysWOW64\\wbem\\wmic.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Avihay Eldad @AvihayEldad"],"references":["https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory","https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/subTee/status/986234811944648707","https://research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/"],"count":7},{"id":"lolbas:workfolders-exe","name":"WorkFolders.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\WorkFolders.exe"],"author":"Elliot Killick","created":"2021-08-16T00:00:00.000Z","contributors":["John Carroll @YoSignals","Elliot Killick @elliotkillick","Naor Evgi @ghosts621"],"references":["https://www.ctus.io/2021/04/12/exploading/","https://twitter.com/ElliotKillick/status/1449812843772227588","https://lolbas-project.github.io/lolbas/Binaries/WorkFolders/"],"count":2},{"id":"lolbas:wscript-exe","name":"Wscript.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wscript.exe","C:\\Windows\\SysWOW64\\wscript.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe","SaiLay(valen) @404death"],"references":["https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f","https://lolbas-project.github.io/lolbas/Binaries/Wscript/"],"count":2},{"id":"lolbas:wsreset-exe","name":"Wsreset.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wsreset.exe"],"author":"Oddvar Moe","created":"2019-03-18T00:00:00.000Z","contributors":["Hashim Jawad @ihack4falafel"],"references":["https://www.activecyber.us/activelabs/windows-uac-bypass","https://twitter.com/ihack4falafel/status/1106644790114947073","https://github.com/hfiref0x/UACME/blob/master/README.md","https://lolbas-project.github.io/lolbas/Binaries/Wsreset/"],"count":1},{"id":"lolbas:wuauclt-exe","name":"wuauclt.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\wuauclt.exe","C:\\Windows\\UUS\\amd64\\wuauclt.exe"],"author":"David Middlehurst","created":"2020-09-23T00:00:00.000Z","contributors":["David Middlehurst @dtmsecurity"],"references":["https://dtm.uk/wuauclt/","https://lolbas-project.github.io/lolbas/Binaries/wuauclt/"],"count":1},{"id":"lolbas:xwizard-exe","name":"Xwizard.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\xwizard.exe","C:\\Windows\\SysWOW64\\xwizard.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Adam @Hexacorn","Nick Tyrer @NickTyrer","harr0ey @harr0ey","Wade Hickey @notwhickey"],"references":["http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/","https://www.youtube.com/watch?v=LwDHX7DVHWU","https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5","https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/","https://twitter.com/notwhickey/status/1306023056847110144","https://lolbas-project.github.io/lolbas/Binaries/Xwizard/"],"count":3},{"id":"lolbas:msedge-proxy-exe","name":"msedge_proxy.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge_proxy.exe"],"author":"Mert Daş","created":"2023-08-18T00:00:00.000Z","contributors":["Mert Daş @merterpreter"],"references":["https://lolbas-project.github.io/lolbas/Binaries/msedge_proxy/"],"count":2},{"id":"lolbas:msedgewebview2-exe","name":"msedgewebview2.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\msedgewebview2.exe","C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\131.0.2903.70\\msedgewebview2.exe"],"author":"Matan Bahar","created":"2023-06-15T00:00:00.000Z","contributors":["Uriel Kosayev @MalFuzzer","Hai Vaknin @VakninHai","Tamir Yehuda @Tamirye94","Matan Bahar @Bl4ckShad3"],"references":["https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf","https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/"],"count":4},{"id":"lolbas:odbcad32-exe","name":"odbcad32.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["c:\\windows\\system32\\odbcad32.exe","c:\\windows\\syswow64\\odbcad32.exe"],"author":"Ekitji","created":"2025-09-04T00:00:00.000Z","contributors":["amonitoring","Ekitji @eki_erk"],"references":["https://medium.com/@thebinaryhashira/living-off-the-land-and-living-above-uac-6a66738d225c","https://lolbas-project.github.io/lolbas/Binaries/odbcad32/"],"count":1},{"id":"lolbas:setupugc-exe","name":"setupugc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\System32\\setupugc.exe","C:\\Windows\\SysWOW64\\setupugc.exe"],"author":"Ang Kar Min","created":"2026-04-20T00:00:00.000Z","contributors":["Ang Kar Min @karminang"],"references":["https://strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html","https://lolbas-project.github.io/lolbas/Binaries/setupugc/"],"count":2},{"id":"lolbas:write-exe","name":"write.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Windows\\write.exe","C:\\Windows\\System32\\write.exe","C:\\Windows\\SysWOW64\\write.exe"],"author":"Michal Belzak","created":"2025-06-17T00:00:00.000Z","contributors":["Michal Belzak"],"references":["https://gist.github.com/mblzk/b8c5ff7c2bd0fb2b385cc2fdd119874b","https://lolbas-project.github.io/lolbas/Binaries/write/"],"count":1},{"id":"lolbas:wt-exe","name":"wt.exe","source":"LOLBAS","platform":["Windows"],"toolType":"Binary","aliases":[],"fullPath":["C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_<version_packageid>\\wt.exe"],"author":"Nasreddine Bencherchali","created":"2022-07-27T00:00:00.000Z","contributors":["Nasreddine Bencherchali @nas_bench"],"references":["https://twitter.com/nas_bench/status/1552100271668469761","https://lolbas-project.github.io/lolbas/Binaries/wt/"],"count":1},{"id":"lolbas:advpack-dll","name":"Advpack.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\advpack.dll","c:\\windows\\syswow64\\advpack.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy (LaunchINFSection) @bohops","Fabrizio (RegisterOCX - DLL) @0rbz_","Moriarty (RegisterOCX - CMD) @moriarty_meng","Nick Carr (Threat Intel) @ItsReallyNick"],"references":["https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/","https://twitter.com/ItsReallyNick/status/967859147977850880","https://twitter.com/bohops/status/974497123101179904","https://twitter.com/moriarty_meng/status/977848311603380224","https://lolbas-project.github.io/lolbas/Libraries/Advpack/"],"count":5},{"id":"lolbas:desk-cpl","name":"Desk.cpl","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["C:\\Windows\\System32\\desk.cpl","C:\\Windows\\SysWOW64\\desk.cpl"],"author":"Hai Vaknin","created":"2022-04-21T00:00:00.000Z","contributors":["Rafael S Marques @pegabizu","Pierre-Alexandre Braeken @pabraeken","hai @VakninHai","Christopher Peacock @SecurePeacock","Jose Luis Sanchez @Joseliyo_Jstnk"],"references":["https://vxug.fakedoma.in/zines/29a/29a7/Articles/29A-7.030.txt","https://twitter.com/pabraeken/status/998627081360695297","https://twitter.com/VakninHai/status/1517027824984547329","https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files","https://lolbas-project.github.io/lolbas/Libraries/Desk/"],"count":2},{"id":"lolbas:dfshim-dll","name":"Dfshim.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Dfsvc.exe","C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Dfsvc.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://github.com/api0cradle/ShmooCon-2015/blob/master/ShmooCon-2015-Simple-WLEvasion.pdf","https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe","https://lolbas-project.github.io/lolbas/Libraries/Dfshim/"],"count":1},{"id":"lolbas:ieadvpack-dll","name":"Ieadvpack.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\ieadvpack.dll","c:\\windows\\syswow64\\ieadvpack.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy (LaunchINFSection) @bohops","Fabrizio (RegisterOCX - DLL) @0rbz_","Pierre-Alexandre Braeken (RegisterOCX - CMD) @pabraeken"],"references":["https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/","https://twitter.com/pabraeken/status/991695411902599168","https://twitter.com/0rbz_/status/974472392012689408","https://lolbas-project.github.io/lolbas/Libraries/Ieadvpack/"],"count":5},{"id":"lolbas:ieframe-dll","name":"Ieframe.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\ieframe.dll","c:\\windows\\syswow64\\ieframe.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops","Adam @hexacorn"],"references":["http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/","https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/","https://twitter.com/bohops/status/997690405092290561","https://windows10dll.nirsoft.net/ieframe_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Ieframe/"],"count":1},{"id":"lolbas:mshtml-dll","name":"Mshtml.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\mshtml.dll","c:\\windows\\syswow64\\mshtml.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/998567549670477824","https://windows10dll.nirsoft.net/mshtml_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Mshtml/"],"count":1},{"id":"lolbas:pcwutl-dll","name":"Pcwutl.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\pcwutl.dll","c:\\windows\\syswow64\\pcwutl.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Matt harr0ey @harr0ey"],"references":["https://twitter.com/harr0ey/status/989617817849876488","https://windows10dll.nirsoft.net/pcwutl_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/"],"count":1},{"id":"lolbas:photoviewer-dll","name":"PhotoViewer.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll","C:\\Program Files (x86)\\Windows Photo Viewer\\PhotoViewer.dll"],"author":"Avihay Eldad","created":"2025-06-22T00:00:00.000Z","contributors":["Avihay Eldad @avihayeldad","Tommy Warren"],"references":["https://lolbas-project.github.io/lolbas/Libraries/PhotoViewer/"],"count":1},{"id":"lolbas:scrobj-dll","name":"Scrobj.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\scrobj.dll","c:\\windows\\syswow64\\scrobj.dll"],"author":"Eral4m","created":"2021-01-07T00:00:00.000Z","contributors":["Eral4m @eral4m"],"references":["https://twitter.com/eral4m/status/1479106975967240209","https://lolbas-project.github.io/lolbas/Libraries/Scrobj/"],"count":1},{"id":"lolbas:setupapi-dll","name":"Setupapi.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\setupapi.dll","c:\\windows\\syswow64\\setupapi.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Kyle Hanslovan (COM Scriptlet) @KyleHanslovan","Huntress Labs (COM Scriptlet) @HuntressLabs","Casey Smith (COM Scriptlet) @subTee","Nick Carr (Threat Intel) @ItsReallyNick"],"references":["https://github.com/huntresslabs/evading-autoruns","https://twitter.com/pabraeken/status/994742106852941825","https://windows10dll.nirsoft.net/setupapi_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Setupapi/"],"count":2},{"id":"lolbas:shdocvw-dll","name":"Shdocvw.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\shdocvw.dll","c:\\windows\\syswow64\\shdocvw.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Adam @hexacorn","Jimmy @bohops"],"references":["http://www.hexacorn.com/blog/2018/03/15/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline-part-5/","https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/","https://twitter.com/bohops/status/997690405092290561","https://windows10dll.nirsoft.net/shdocvw_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Shdocvw/"],"count":1},{"id":"lolbas:shell32-dll","name":"Shell32.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\shell32.dll","c:\\windows\\syswow64\\shell32.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Adam (Control_RunDLL, Control_RunDLLNoFallback) @hexacorn","Pierre-Alexandre Braeken (ShellExec_RunDLL) @pabraeken","Matt Graeber (ShellExec_RunDLL) @mattifestation","Kyle Hanslovan (ShellExec_RunDLL) @KyleHanslovan"],"references":["https://twitter.com/Hexacorn/status/885258886428725250","https://twitter.com/pabraeken/status/991768766898941953","https://twitter.com/mattifestation/status/776574940128485376","https://twitter.com/KyleHanslovan/status/905189665120149506","https://windows10dll.nirsoft.net/shell32_dll.html","https://www.hexacorn.com/blog/2025/05/18/shell32-dll-44-lolbin/","https://lolbas-project.github.io/lolbas/Libraries/Shell32/"],"count":4},{"id":"lolbas:shimgvw-dll","name":"Shimgvw.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\shimgvw.dll","c:\\windows\\syswow64\\shimgvw.dll"],"author":"Eral4m","created":"2021-01-06T00:00:00.000Z","contributors":["Eral4m @eral4m"],"references":["https://twitter.com/eral4m/status/1479080793003671557","https://lolbas-project.github.io/lolbas/Libraries/Shimgvw/"],"count":1},{"id":"lolbas:syssetup-dll","name":"Syssetup.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\syssetup.dll","c:\\windows\\syswow64\\syssetup.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken (Execute) @pabraeken","Matt harr0ey (Execute) @harr0ey","Jimmy (Scriptlet) @bohops"],"references":["https://twitter.com/pabraeken/status/994392481927258113","https://twitter.com/harr0ey/status/975350238184697857","https://twitter.com/bohops/status/975549525938135040","https://windows10dll.nirsoft.net/syssetup_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Syssetup/"],"count":2},{"id":"lolbas:url-dll","name":"Url.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\url.dll","c:\\windows\\syswow64\\url.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Adam (OpenURL) @hexacorn","Jimmy (OpenURL) @bohops","Malwrologist (FileProtocolHandler - HTA) @DissectMalware","r0lan (Obfuscation) @r0lan"],"references":["https://bohops.com/2018/03/17/abusing-exported-functions-and-exposed-dcom-interfaces-for-pass-thru-command-execution-and-lateral-movement/","https://twitter.com/DissectMalware/status/995348436353470465","https://twitter.com/bohops/status/974043815655956481","https://twitter.com/yeyint_mth/status/997355558070927360","https://twitter.com/Hexacorn/status/974063407321223168","https://windows10dll.nirsoft.net/url_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Url/"],"count":6},{"id":"lolbas:zipfldr-dll","name":"Zipfldr.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\zipfldr.dll","c:\\windows\\syswow64\\zipfldr.dll"],"author":"LOLBAS Team","created":"2018-05-25T00:00:00.000Z","contributors":["Moriarty (Execution) @moriarty_meng","r0lan (Obfuscation) @r0lan"],"references":["https://twitter.com/moriarty_meng/status/977848311603380224","https://twitter.com/bohops/status/997896811904929792","https://windows10dll.nirsoft.net/zipfldr_dll.html","https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/"],"count":2},{"id":"lolbas:comsvcs-dll","name":"Comsvcs.dll","source":"LOLBAS","platform":["Windows"],"toolType":"Library","aliases":[],"fullPath":["c:\\windows\\system32\\comsvcs.dll"],"author":"LOLBAS Team","created":"2019-08-30T00:00:00.000Z","contributors":["modexp"],"references":["https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/","https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/"],"count":1},{"id":"lolbas:cl-loadassembly-ps1","name":"CL_LoadAssembly.ps1","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\diagnostics\\system\\Audio\\CL_LoadAssembly.ps1"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/","https://lolbas-project.github.io/lolbas/Scripts/CL_LoadAssembly/"],"count":1},{"id":"lolbas:cl-mutexverifiers-ps1","name":"CL_Mutexverifiers.ps1","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1","C:\\Windows\\diagnostics\\system\\Audio\\CL_Mutexverifiers.ps1","C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Mutexverifiers.ps1","C:\\Windows\\diagnostics\\system\\Video\\CL_Mutexverifiers.ps1","C:\\Windows\\diagnostics\\system\\Speech\\CL_Mutexverifiers.ps1"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/995111125447577600","https://lolbas-project.github.io/lolbas/Scripts/CL_Mutexverifiers/"],"count":1},{"id":"lolbas:cl-invocation-ps1","name":"CL_Invocation.ps1","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\diagnostics\\system\\AERO\\CL_Invocation.ps1","C:\\Windows\\diagnostics\\system\\Audio\\CL_Invocation.ps1","C:\\Windows\\diagnostics\\system\\WindowsUpdate\\CL_Invocation.ps1"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops","Pierre-Alexandre Braeken @pabraeken"],"references":["https://lolbas-project.github.io/lolbas/Scripts/CL_Invocation/"],"count":1},{"id":"lolbas:launch-vsdevshell-ps1","name":"Launch-VsDevShell.ps1","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1","C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\Tools\\Launch-VsDevShell.ps1"],"author":"Nasreddine Bencherchali","created":"2022-06-13T00:00:00.000Z","contributors":["Nasreddine Bencherchali @nas_bench"],"references":["https://twitter.com/nas_bench/status/1535981653239255040","https://lolbas-project.github.io/lolbas/Scripts/Launch-VsDevShell/"],"count":2},{"id":"lolbas:manage-bde-wsf","name":"Manage-bde.wsf","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\System32\\manage-bde.wsf"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Jimmy @bohops","Daniel Bohannon @danielbohannon","John Lambert @JohnLaTwC"],"references":["https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712","https://twitter.com/bohops/status/980659399495741441","https://twitter.com/JohnLaTwC/status/1223292479270600706","https://lolbas-project.github.io/lolbas/Scripts/Manage-bde.wsf/"],"count":2},{"id":"lolbas:pubprn-vbs","name":"Pubprn.vbs","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn.vbs","C:\\Windows\\SysWOW64\\Printing_Admin_Scripts\\en-US\\pubprn.vbs"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Nelson @enigma0x3"],"references":["https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/","https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology","https://github.com/enigma0x3/windows-operating-system-archaeology","https://lolbas-project.github.io/lolbas/Scripts/Pubprn/"],"count":1},{"id":"lolbas:syncappvpublishingserver-vbs","name":"Syncappvpublishingserver.vbs","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\System32\\SyncAppvPublishingServer.vbs"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Nick Landers @monoxgas","Casey Smith @subtee"],"references":["https://twitter.com/monoxgas/status/895045566090010624","https://twitter.com/subTee/status/855738126882316288","https://lolbas-project.github.io/lolbas/Scripts/Syncappvpublishingserver/"],"count":1},{"id":"lolbas:utilityfunctions-ps1","name":"UtilityFunctions.ps1","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\diagnostics\\system\\Networking\\UtilityFunctions.ps1"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Nick VanGilder @nickvangilder"],"references":["https://twitter.com/nickvangilder/status/1441003666274668546","https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/"],"count":1},{"id":"lolbas:winrm-vbs","name":"winrm.vbs","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["C:\\Windows\\System32\\winrm.vbs","C:\\Windows\\SysWOW64\\winrm.vbs"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Graeber @mattifestation","Matt Nelson @enigma0x3","Casey Smith @subtee","Jimmy @bohops","Red Canary Company cc Tony Lambert @redcanaryco"],"references":["https://www.slideshare.net/enigma0x3/windows-operating-system-archaeology","https://www.youtube.com/watch?v=3gz1QmiMhss","https://github.com/enigma0x3/windows-operating-system-archaeology","https://redcanary.com/blog/lateral-movement-winrm-wmi/","https://twitter.com/bohops/status/994405551751815170","https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404","https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf","https://lolbas-project.github.io/lolbas/Scripts/winrm/"],"count":3},{"id":"lolbas:pester-bat","name":"Pester.bat","source":"LOLBAS","platform":["Windows"],"toolType":"Script","aliases":[],"fullPath":["c:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\<VERSION>\\bin\\Pester.bat"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Emin Atac @p0w3rsh3ll","Stamatis Chatzimangou @_st0pp3r_"],"references":["https://twitter.com/Oddvarmoe/status/993383596244258816","https://twitter.com/_st0pp3r_/status/1560072680887525378","https://lolbas-project.github.io/lolbas/Scripts/Pester/"],"count":2},{"id":"lolbas:acccheckconsole-exe","name":"AccCheckConsole.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x86\\AccChecker\\AccCheckConsole.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\x64\\AccChecker\\AccCheckConsole.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\arm\\AccChecker\\AccCheckConsole.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.22000.0\\arm64\\AccChecker\\AccCheckConsole.exe"],"author":"bohops","created":"2022-01-02T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340","https://twitter.com/bohops/status/1477717351017680899","https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/"],"count":2},{"id":"lolbas:adplus-exe","name":"adplus.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\adplus.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\adplus.exe"],"author":"mr.d0x","created":"2021-09-01T00:00:00.000Z","contributors":["mr.d0x @mrd0x","Nasreddine Bencherchali @nas_bench"],"references":["https://mrd0x.com/adplus-debugging-tool-lsass-dump/","https://twitter.com/nas_bench/status/1534916659676422152","https://twitter.com/nas_bench/status/1534915321856917506","https://lolbas-project.github.io/lolbas/OtherMSBinaries/adplus/"],"count":4},{"id":"lolbas:agentexecutor-exe","name":"AgentExecutor.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe"],"author":"Eleftherios Panos","created":"2020-07-23T00:00:00.000Z","contributors":["Eleftherios Panos @lefterispan"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/AgentExecutor/"],"count":2},{"id":"lolbas:applauncher-exe","name":"AppLauncher.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Microsoft User Experience Virtualization\\Management\\AppLauncher.exe"],"author":"Avihay Eldad","created":"2025-09-21T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/microsoft-desktop-optimization-pack/ue-v/uev-getting-started","https://lolbas-project.github.io/lolbas/OtherMSBinaries/AppLauncher/"],"count":1},{"id":"lolbas:appcert-exe","name":"AppCert.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\App Certification Kit\\appcert.exe","C:\\Program Files\\Windows Kits\\10\\App Certification Kit\\appcert.exe"],"author":"Avihay Eldad","created":"2024-03-06T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/windows/win32/win_cert/using-the-windows-app-certification-kit","https://lolbas-project.github.io/lolbas/OtherMSBinaries/AppCert/"],"count":2},{"id":"lolbas:appvlp-exe","name":"Appvlp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Office\\root\\client\\appvlp.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\client\\appvlp.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["fab @0rbz_","Will @moo_hax","Matt Wilson @enigma0x3"],"references":["https://github.com/MoooKitty/Code-Execution","https://twitter.com/moo_hax/status/892388990686347264","https://enigma0x3.net/2018/06/11/the-tale-of-settingcontent-ms-files/","https://securityboulevard.com/2018/07/attackers-test-new-document-attack-vector-that-slips-past-office-defenses/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/"],"count":2},{"id":"lolbas:bcp-exe","name":"Bcp.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\170\\Tools\\Binn\\bcp.exe","C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\130\\Tools\\Binn\\bcp.exe","C:\\Program Files\\Microsoft SQL Server\\Client SDK\\ODBC\\110\\Tools\\Binn\\bcp.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\Client SDK\\ODBC\\170\\Tools\\Binn\\bcp.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\Client SDK\\ODBC\\130\\Tools\\Binn\\bcp.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\Client SDK\\ODBC\\110\\Tools\\Binn\\bcp.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\120\\Tools\\Binn\\bcp.exe"],"author":"Mahir Ali Khan","created":"2025-11-13T00:00:00.000Z","contributors":["Mahir Ali Khan @mahiralikhan07"],"references":["https://docs.microsoft.com/en-us/sql/tools/bcp-utility","https://asec.ahnlab.com/en/61000/","https://asec.ahnlab.com/en/78944/","https://www.huntress.com/blog/attacking-mssql-servers","https://www.huntress.com/blog/attacking-mssql-servers-pt-ii","https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/","https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bcp/"],"count":1},{"id":"lolbas:bginfo-exe","name":"Bginfo.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Oddvar Moe @oddvarmoe"],"references":["https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/"],"count":6},{"id":"lolbas:cdb-exe","name":"Cdb.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\cdb.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\cdb.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Graeber @mattifestation","mr.d0x @mrd0x","Spooky Sec @sec_spooky","Nasreddine Bencherchali @nas_bench"],"references":["http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html","https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options","https://gist.github.com/mattifestation/94e2b0a9e3fe1ac0a433b5c3e6bd0bda","https://mrd0x.com/the-power-of-cdb-debugging-tool/","https://twitter.com/nas_bench/status/1534957360032120833","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/"],"count":3},{"id":"lolbas:coregen-exe","name":"coregen.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe","C:\\Program Files (x86)\\Microsoft Silverlight\\5.1.50918.0\\coregen.exe"],"author":"Martin Sohn Christensen","created":"2020-10-09T00:00:00.000Z","contributors":["Nicky Tyrer","Evan Pena","Casey Erikson"],"references":["https://www.youtube.com/watch?v=75XImxOOInU","https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html","https://lolbas-project.github.io/lolbas/OtherMSBinaries/coregen/"],"count":3},{"id":"lolbas:createdump-exe","name":"Createdump.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe","C:\\Program Files (x86)\\dotnet\\shared\\Microsoft.NETCore.App\\<version>\\createdump.exe","C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\dotnet\\runtime\\shared\\Microsoft.NETCore.App\\6.0.0\\createdump.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\dotnet\\runtime\\shared\\Microsoft.NETCore.App\\6.0.0\\createdump.exe"],"author":"mr.d0x, Daniel Santos","created":"2022-01-20T00:00:00.000Z","contributors":["bopin @bopin2020"],"references":["https://twitter.com/bopin2020/status/1366400799199272960","https://docs.microsoft.com/en-us/troubleshoot/developer/webapps/aspnetcore/practice-troubleshoot-linux/lab-1-3-capture-core-crash-dumps","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Createdump/"],"count":1},{"id":"lolbas:csi-exe","name":"csi.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\Program Files (x86)\\Microsoft Visual Studio\\2017\\Community\\MSBuild\\15.0\\Bin\\Roslyn\\csi.exe","c:\\Program Files (x86)\\Microsoft Web Tools\\Packages\\Microsoft.Net.Compilers.X.Y.Z\\tools\\csi.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee"],"references":["https://twitter.com/subTee/status/781208810723549188","https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/csi/"],"count":1},{"id":"lolbas:defaultpack-exe","name":"DefaultPack.EXE","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft\\DefaultPack\\DefaultPack.exe"],"author":"@checkymander","created":"2020-10-01T00:00:00.000Z","contributors":["checkymander @checkymander"],"references":["https://twitter.com/checkymander/status/1311509470275604480.","https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/"],"count":1},{"id":"lolbas:devinit-exe","name":"Devinit.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\Tools\\devinit\\devinit.exe"],"author":"mr.d0x","created":"2022-01-20T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://twitter.com/mrd0x/status/1460815932402679809","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/"],"count":1},{"id":"lolbas:devtoolslauncher-exe","name":"Devtoolslauncher.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\windows\\system32\\devtoolslauncher.exe"],"author":"felamos","created":"2019-10-04T00:00:00.000Z","contributors":["felamos @_felamos"],"references":["https://twitter.com/_felamos/status/1179811992841797632","https://www.virustotal.com/gui/file/84877a507af8b70c145777a87eaf28a8327c50a1563fe650f34572bef8a42ff6/details","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/"],"count":2},{"id":"lolbas:dnx-exe","name":"dnx.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Nelson @enigma0x3"],"references":["https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/dnx/"],"count":1},{"id":"lolbas:dotnet-exe","name":"Dotnet.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\dotnet\\dotnet.exe"],"author":"felamos","created":"2019-11-12T00:00:00.000Z","contributors":["felamos @_felamos","Jimmy @bohops","yamalon @mavinject"],"references":["https://twitter.com/_felamos/status/1204705548668555264","https://gist.github.com/bohops/3f645a7238d8022830ecf5511b3ecfbc","https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/","https://learn.microsoft.com/en-us/dotnet/fsharp/tools/fsharp-interactive/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/"],"count":4},{"id":"lolbas:dsdbutil-exe","name":"dsdbutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":["dsDbUtil.exe"],"fullPath":["C:\\Windows\\System32\\dsdbutil.exe","C:\\Windows\\SysWOW64\\dsdbutil.exe"],"author":"Ekitji","created":"2023-05-31T00:00:00.000Z","contributors":["bohop @bohops","Ekitji @eki_erk"],"references":["https://gist.github.com/bohops/88561ca40998e83deb3d1da90289e358","https://www.netwrix.com/ntds_dit_security_active_directory.html","https://lolbas-project.github.io/lolbas/OtherMSBinaries/dsdbutil/"],"count":5},{"id":"lolbas:dtutil-exe","name":"dtutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\<version>\\DTS\\Binn\\dtutil.exe"],"author":"Avihay Eldad","created":"2024-06-17T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/sql/integration-services/dtutil-utility?view=sql-server-ver16","https://lolbas-project.github.io/lolbas/OtherMSBinaries/dtutil/"],"count":1},{"id":"lolbas:dump64-exe","name":"Dump64.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\Feedback\\dump64.exe"],"author":"mr.d0x","created":"2021-11-16T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://twitter.com/mrd0x/status/1460597833917251595","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dump64/"],"count":1},{"id":"lolbas:dumpminitool-exe","name":"DumpMinitool.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\Extensions\\TestPlatform\\Extensions\\DumpMinitool.exe"],"author":"mr.d0x","created":"2022-01-20T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://twitter.com/mrd0x/status/1511415432888131586","https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/"],"count":1},{"id":"lolbas:dxcap-exe","name":"Dxcap.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Windows\\System32\\dxcap.exe","C:\\Windows\\SysWOW64\\dxcap.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt harr0ey @harr0ey","Vikas Singh @vikas891","Naor Evgi @ghosts621"],"references":["https://twitter.com/harr0ey/status/992008180904419328","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/"],"count":2},{"id":"lolbas:ecmangen-exe","name":"ECMangen.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\ECMangen.exe","C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\Bin\\x64\\ECMangen.exe","C:\\Program Files\\Microsoft\\Exchange Server\\<version>\\Bin\\ECMangen.exe","C:\\Program Files\\Microsoft\\Exchange Server\\Bin\\ECMangen.exe","C:\\Program Files\\Microsoft\\Exchange Server\\ClientAccess\\Bin\\ECMangen.exe","C:\\ExchangeServer\\Bin\\ECMangen.exe"],"author":"Avihay Eldad","created":"2024-04-30T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/ECMangen/"],"count":1},{"id":"lolbas:excel-exe","name":"Excel.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Excel.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\Excel.exe","C:\\Program Files\\Microsoft Office\\Office16\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\Excel.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\Excel.exe","C:\\Program Files\\Microsoft Office\\Office15\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\Excel.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\Excel.exe","C:\\Program Files\\Microsoft Office\\Office14\\Excel.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\Excel.exe","C:\\Program Files\\Microsoft Office\\Office12\\Excel.exe","C:\\Program Files\\Microsoft Office\\Office12\\Excel.exe"],"author":"Reegun J (OCBC Bank)","created":"2019-07-19T00:00:00.000Z","contributors":["Reegun J (OCBC Bank) @reegun21"],"references":["https://twitter.com/reegun21/status/1150032506504151040","https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/"],"count":1},{"id":"lolbas:fsi-exe","name":"Fsi.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\dotnet\\sdk\\<version>\\FSharp\\fsi.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsi.exe"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Nick Tyrer @NickTyrer","Jimmy @bohops"],"references":["https://twitter.com/NickTyrer/status/904273264385589248","https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/"],"count":2},{"id":"lolbas:fsianycpu-exe","name":"FsiAnyCpu.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\CommonExtensions\\Microsoft\\FSharp\\fsianycpu.exe"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Nick Tyrer @NickTyrer","Jimmy @bohops"],"references":["https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/"],"count":2},{"id":"lolbas:intellitrace-exe","name":"IntelliTrace.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\IntelliTrace\\IntelliTrace.exe"],"author":"Avihay Eldad","created":"2025-09-21T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/visualstudio/debugger/intellitrace","https://lolbas-project.github.io/lolbas/OtherMSBinaries/IntelliTrace/"],"count":1},{"id":"lolbas:logger-exe","name":"Logger.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\logger.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\logger.exe","C:\\Program Files\\Windows Kits\\10\\Debuggers\\x86\\logger.exe","C:\\Program Files\\Windows Kits\\10\\Debuggers\\x64\\logger.exe"],"author":"Avihay Eldad","created":"2025-07-13T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/logger","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Logger/"],"count":3},{"id":"lolbas:mftrace-exe","name":"Mftrace.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x86\\mftrace.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\10.0.16299.0\\x64\\mftrace.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\mftrace.exe","C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x64\\mftrace.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["fabrizio @0rbz_"],"references":["https://twitter.com/0rbz_/status/988911181422186496","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/"],"count":1},{"id":"lolbas:microsoft-nodejstools-pressanykey-exe","name":"Microsoft.NodejsTools.PressAnyKey.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\Extensions\\Microsoft\\NodeJsTools\\NodeJsTools\\Microsoft.NodejsTools.PressAnyKey.exe"],"author":"mr.d0x","created":"2022-01-20T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://twitter.com/mrd0x/status/1463526834918854661","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Microsoft.NodejsTools.PressAnyKey/"],"count":1},{"id":"lolbas:mpiexec-exe","name":"Mpiexec.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft MPI\\Bin\\mpiexec.exe","C:\\Program Files (x86)\\Microsoft MPI\\Bin\\mpiexec.exe"],"author":"Avihay Eldad","created":"2025-09-25T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mpiexec/"],"count":1},{"id":"lolbas:msaccess-exe","name":"MSAccess.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSAccess.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSAccess.exe","C:\\Program Files\\Microsoft Office\\Office16\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\MSAccess.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\MSAccess.exe","C:\\Program Files\\Microsoft Office\\Office15\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\MSAccess.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSAccess.exe","C:\\Program Files\\Microsoft Office\\Office14\\MSAccess.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\MSAccess.exe","C:\\Program Files\\Microsoft Office\\Office12\\MSAccess.exe"],"author":"Nir Chako","created":"2023-04-30T00:00:00.000Z","contributors":["Nir Chako @C_h4ck_0"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/MSAccess/"],"count":1},{"id":"lolbas:mscopilot-exe","name":"Mscopilot.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot.exe"],"author":"4n4s4zi","created":"2026-04-14T00:00:00.000Z","contributors":["4n4s4zi @4n4s4zi"],"references":["https://github.com/4n4s4zi/tour-de-mscopilot","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mscopilot/"],"count":1},{"id":"lolbas:mscopilot-proxy-exe","name":"Mscopilot_proxy.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft\\Copilot\\Application\\mscopilot_proxy.exe"],"author":"4n4s4zi","created":"2026-04-14T00:00:00.000Z","contributors":["4n4s4zi @4n4s4zi"],"references":["https://github.com/4n4s4zi/tour-de-mscopilot","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mscopilot_proxy/"],"count":1},{"id":"lolbas:msdeploy-exe","name":"Msdeploy.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe","C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V2\\msdeploy.exe","C:\\Program Files\\IIS\\Microsoft Web Deploy V3\\msdeploy.exe","C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V3\\msdeploy.exe","C:\\Program Files\\IIS\\Microsoft Web Deploy V4\\msdeploy.exe","C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V4\\msdeploy.exe","C:\\Program Files\\IIS\\Microsoft Web Deploy V5\\msdeploy.exe","C:\\Program Files (x86)\\IIS\\Microsoft Web Deploy V5\\msdeploy.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken","Avihay Eldad @AvihayEldad"],"references":["https://twitter.com/pabraeken/status/995837734379032576","https://twitter.com/pabraeken/status/999090532839313408","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/"],"count":3},{"id":"lolbas:msohtmed-exe","name":"MsoHtmEd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office\\Office16\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office\\Office15\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office\\Office12\\MSOHTMED.exe","C:\\Program Files\\Microsoft Office\\Office12\\MSOHTMED.exe"],"author":"Nir Chako","created":"2022-07-24T00:00:00.000Z","contributors":["Nir Chako (Pentera) @C_h4ck_0"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/MsoHtmEd/"],"count":1},{"id":"lolbas:mspub-exe","name":"Mspub.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\MSPUB.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\MSPUB.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSPUB.exe","C:\\Program Files\\Microsoft Office\\Office16\\MSPUB.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\MSPUB.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\MSPUB.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\MSPUB.exe","C:\\Program Files\\Microsoft Office\\Office15\\MSPUB.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\MSPUB.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\MSPUB.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.exe","C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.exe"],"author":"Nir Chako","created":"2022-08-02T00:00:00.000Z","contributors":["Nir Chako (Pentera) @C_h4ck_0"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mspub/"],"count":1},{"id":"lolbas:msxsl-exe","name":"msxsl.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subtee","Ronnie Salomonsen @r0ns3n"],"references":["https://twitter.com/subTee/status/877616321747271680","https://github.com/3gstudent/Use-msxsl-to-bypass-AppLocker","https://github.com/RonnieSalomonsen/Use-msxsl-to-download-file","https://lolbas-project.github.io/lolbas/OtherMSBinaries/msxsl/"],"count":6},{"id":"lolbas:nmcap-exe","name":"Nmcap.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Network Monitor 3\\nmcap.exe","C:\\Program Files (x86)\\Microsoft Network Monitor 3\\nmcap.exe"],"author":"Avihay Eldad","created":"2025-09-16T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/network-monitor-3","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Nmcap/"],"count":1},{"id":"lolbas:ntdsutil-exe","name":"ntdsutil.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Windows\\System32\\ntdsutil.exe"],"author":"Tony Lambert","created":"2020-01-10T00:00:00.000Z","contributors":["Sean Metcalf @PyroTek3"],"references":["https://adsecurity.org/?p=2398#CreateIFM","https://lolbas-project.github.io/lolbas/OtherMSBinaries/ntdsutil/"],"count":1},{"id":"lolbas:ntsd-exe","name":"Ntsd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\ntsd.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\ntsd.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\ntsd.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm64\\ntsd.exe"],"author":"Avihay Eldad","created":"2025-07-16T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options","https://strontic.github.io/xcyclopedia/library/ntsd.exe-629EA12D527237B9CD945AC44C2DE80D.html","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Ntsd/"],"count":1},{"id":"lolbas:openconsole-exe","name":"OpenConsole.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os86\\OpenConsole.exe","C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\Terminal\\ServiceHub\\os64\\OpenConsole.exe","C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\\OpenConsole.exe"],"author":"Nasreddine Bencherchali","created":"2022-06-17T00:00:00.000Z","contributors":["Nasreddine Bencherchali @nas_bench"],"references":["https://twitter.com/nas_bench/status/1537563834478645252","https://lolbas-project.github.io/lolbas/OtherMSBinaries/OpenConsole/"],"count":1},{"id":"lolbas:outlook-exe","name":"Outlook.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Outlook.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\Outlook.exe","C:\\Program Files\\Microsoft Office\\Office16\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\Outlook.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\Outlook.exe","C:\\Program Files\\Microsoft Office\\Office15\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\Outlook.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\Outlook.exe","C:\\Program Files\\Microsoft Office\\Office14\\Outlook.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\Outlook.exe","C:\\Program Files\\Microsoft Office\\Office12\\Outlook.exe","C:\\Program Files\\Microsoft Office\\Office12\\Outlook.exe"],"author":"Nir Chako","created":"2022-11-08T00:00:00.000Z","contributors":["Nir Chako (Pentera) @C_h4ck_0"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Outlook/"],"count":1},{"id":"lolbas:pixtool-exe","name":"Pixtool.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft PIX\\pixtool.exe","C:\\Program Files (x86)\\Microsoft PIX\\pixtool.exe"],"author":"Avihay Eldad","created":"2025-09-21T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://devblogs.microsoft.com/pix/pixtool/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Pixtool/"],"count":1},{"id":"lolbas:powerpnt-exe","name":"Powerpnt.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\Powerpnt.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\Powerpnt.exe","C:\\Program Files\\Microsoft Office\\Office16\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\Powerpnt.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\Powerpnt.exe","C:\\Program Files\\Microsoft Office\\Office15\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\Powerpnt.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\Powerpnt.exe","C:\\Program Files\\Microsoft Office\\Office14\\Powerpnt.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\Powerpnt.exe","C:\\Program Files\\Microsoft Office\\Office12\\Powerpnt.exe","C:\\Program Files\\Microsoft Office\\Office12\\Powerpnt.exe"],"author":"Reegun J (OCBC Bank)","created":"2019-07-19T00:00:00.000Z","contributors":["Reegun J (OCBC Bank) @reegun21"],"references":["https://twitter.com/reegun21/status/1150032506504151040","https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/"],"count":1},{"id":"lolbas:procdump-exe","name":"Procdump.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":["Procdump64.exe"],"fullPath":["no default"],"author":"Alfie Champion (@ajpc500)","created":"2020-10-14T00:00:00.000Z","contributors":["Alfie Champion @ajpc500"],"references":["https://twitter.com/ajpc500/status/1448588362382778372?s=20","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Procdump/"],"count":2},{"id":"lolbas:protocolhandler-exe","name":"ProtocolHandler.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\ProtocolHandler.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\ProtocolHandler.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\ProtocolHandler.exe","C:\\Program Files\\Microsoft Office\\Office16\\ProtocolHandler.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\ProtocolHandler.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\ProtocolHandler.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\ProtocolHandler.exe","C:\\Program Files\\Microsoft Office\\Office15\\ProtocolHandler.exe"],"author":"Nir Chako","created":"2022-07-24T00:00:00.000Z","contributors":["Nir Chako (Pentera) @C_h4ck_0"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/"],"count":1},{"id":"lolbas:rcsi-exe","name":"rcsi.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Matt Nelson @enigma0x3"],"references":["https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/rcsi/"],"count":2},{"id":"lolbas:remote-exe","name":"Remote.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\remote.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\remote.exe"],"author":"mr.d0x","created":"2021-06-01T00:00:00.000Z","contributors":["mr.d0x @mrd0x"],"references":["https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/"],"count":3},{"id":"lolbas:sqldumper-exe","name":"Sqldumper.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft SQL Server\\90\\Shared\\SQLDumper.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\vfs\\ProgramFilesX86\\Microsoft Analysis\\AS OLEDB\\140\\SQLDumper.exe","C:\\Program Files\\Microsoft Power BI Desktop\\bin\\SqlDumper.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Luis Rocha @countuponsec"],"references":["https://twitter.com/countuponsec/status/910969424215232518","https://twitter.com/countuponsec/status/910977826853068800","https://support.microsoft.com/en-us/help/917825/how-to-use-the-sqldumper-exe-utility-to-generate-a-dump-file-in-sql-se","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/"],"count":2},{"id":"lolbas:sqlps-exe","name":"Sqlps.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program files (x86)\\Microsoft SQL Server\\100\\Tools\\Binn\\sqlps.exe","C:\\Program files (x86)\\Microsoft SQL Server\\110\\Tools\\Binn\\sqlps.exe","C:\\Program files (x86)\\Microsoft SQL Server\\120\\Tools\\Binn\\sqlps.exe","C:\\Program files (x86)\\Microsoft SQL Server\\130\\Tools\\Binn\\sqlps.exe","C:\\Program Files (x86)\\Microsoft SQL Server\\150\\Tools\\Binn\\SQLPS.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Bryon @bryon_","Manny @ManuelBerrueta"],"references":["https://twitter.com/ManuelBerrueta/status/1527289261350760455","https://twitter.com/bryon_/status/975835709587075072","https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/"],"count":1},{"id":"lolbas:sqltoolsps-exe","name":"SQLToolsPS.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program files (x86)\\Microsoft SQL Server\\130\\Tools\\Binn\\sqlps.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/993298228840992768","https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017","https://lolbas-project.github.io/lolbas/OtherMSBinaries/SQLToolsPS/"],"count":1},{"id":"lolbas:squirrel-exe","name":"Squirrel.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Squirrel.exe"],"author":"Reegun J (OCBC Bank) - @reegun21","created":"2019-06-26T00:00:00.000Z","contributors":["Reegun J (OCBC Bank) @reegun21","Adam @Hexacorn"],"references":["https://www.youtube.com/watch?v=rOP3hnkj7ls","https://twitter.com/reegun21/status/1144182772623269889","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/","https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12","https://medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/"],"count":5},{"id":"lolbas:te-exe","name":"te.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Giuseppe N3mes1s @gN3mes1s","Avihay Eldad @AvihayEldad"],"references":["https://twitter.com/gn3mes1s/status/927680266390384640","https://github.com/LOLBAS-Project/LOLBAS/pull/359","https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/authoring-tests","https://lolbas-project.github.io/lolbas/OtherMSBinaries/te/"],"count":2},{"id":"lolbas:teams-exe","name":"Teams.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe"],"author":"Andrew Kisliakov","created":"2022-01-17T00:00:00.000Z","contributors":["Andrew Kisliakov","mr.d0x @mrd0x"],"references":["https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Teams/"],"count":3},{"id":"lolbas:testwindowremoteagent-exe","name":"TestWindowRemoteAgent.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\RemoteAgent\\TestWindowRemoteAgent.exe"],"author":"Onat Uzunyayla","created":"2023-08-21T00:00:00.000Z","contributors":["Onat Uzunyayla"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/TestWindowRemoteAgent/"],"count":1},{"id":"lolbas:tracker-exe","name":"Tracker.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["no default"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Casey Smith @subTee"],"references":["https://twitter.com/subTee/status/793151392185589760","https://attack.mitre.org/wiki/Execution","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/"],"count":2},{"id":"lolbas:update-exe","name":"Update.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<username>\\AppData\\Local\\Microsoft\\Teams\\update.exe"],"author":"Oddvar Moe","created":"2019-06-26T00:00:00.000Z","contributors":["Reegun Richard Jayapaul (SpiderLabs, Trustwave) @reegun21","Mr.Un1k0d3r @MrUn1k0d3r","Adam @Hexacorn","Jesus Galvez"],"references":["https://www.youtube.com/watch?v=rOP3hnkj7ls","https://twitter.com/reegun21/status/1144182772623269889","https://twitter.com/MrUn1k0d3r/status/1143928885211537408","https://twitter.com/reegun21/status/1291005287034281990","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/","https://medium.com/@reegun/nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-80c9df51cf12","https://medium.com/@reegun/update-nuget-squirrel-uncontrolled-endpoints-leads-to-arbitrary-code-execution-b55295144b56","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/microsoft-teams-updater-living-off-the-land/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Update/"],"count":13},{"id":"lolbas:vsdiagnostics-exe","name":"VSDiagnostics.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Team Tools\\DiagnosticsHub\\Collector\\VSDiagnostics.exe"],"author":"Bobby Cooke","created":"2023-07-12T00:00:00.000Z","contributors":["Bobby Cooke @0xBoku"],"references":["https://twitter.com/0xBoku/status/1679200664013135872","https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSDiagnostics/"],"count":2},{"id":"lolbas:vsiisexelauncher-exe","name":"VSIISExeLauncher.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\Common7\\IDE\\Extensions\\Microsoft\\Web Tools\\ProjectSystem\\VSIISExeLauncher.exe"],"author":"timwhite","created":"2021-09-24T00:00:00.000Z","contributors":["timwhite"],"references":["https://github.com/timwhitez","https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/"],"count":1},{"id":"lolbas:visio-exe","name":"Visio.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office\\Office14\\Visio.exe","C:\\Program Files\\Microsoft Office\\Office14\\Visio.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\Visio.exe","C:\\Program Files\\Microsoft Office\\Office15\\Visio.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\Visio.exe","C:\\Program Files\\Microsoft Office\\Office16\\Visio.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office14\\Visio.exe","C:\\Program Files\\Microsoft Office\\root\\Office14\\Visio.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office15\\Visio.exe","C:\\Program Files\\Microsoft Office\\root\\Office15\\Visio.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\Visio.exe","C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio.exe"],"author":"Avihay Eldad","created":"2024-02-15T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Visio/"],"count":1},{"id":"lolbas:visualuiaverifynative-exe","name":"VisualUiaVerifyNative.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\arm64\\UIAVerify\\VisualUiaVerifyNative.exe","c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\UIAVerify\\VisualUiaVerifyNative.exe","c:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\UIAVerify\\VisualUiaVerifyNative.exe"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Lee Christensen @tifkin","Jimmy @bohops"],"references":["https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/","https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad","https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/"],"count":1},{"id":"lolbas:vslaunchbrowser-exe","name":"VSLaunchBrowser.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\<version>\\Community\\Common7\\IDE\\VSLaunchBrowser.exe"],"author":"Avihay Eldad","created":"2024-04-12T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSLaunchBrowser/"],"count":3},{"id":"lolbas:vshadow-exe","name":"Vshadow.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\bin\\<version>\\x64\\vshadow.exe"],"author":"Ayberk Halaç","created":"2023-09-06T00:00:00.000Z","contributors":["Ayberk Halaç"],"references":["https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/"],"count":1},{"id":"lolbas:vsjitdebugger-exe","name":"vsjitdebugger.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\windows\\system32\\vsjitdebugger.exe"],"author":"Oddvar Moe","created":"2018-05-25T00:00:00.000Z","contributors":["Pierre-Alexandre Braeken @pabraeken"],"references":["https://twitter.com/pabraeken/status/990758590020452353","https://lolbas-project.github.io/lolbas/OtherMSBinaries/vsjitdebugger/"],"count":1},{"id":"lolbas:wfmformat-exe","name":"WFMFormat.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\there\\is\\no\\default\\installation\\path\\WFMFormat.exe"],"author":"Tim Baker","created":"2024-12-05T00:00:00.000Z","contributors":["Tim Baker (https://www.dotsec.com)"],"references":["https://www.microsoft.com/en-us/download/details.aspx?id=103244","https://lolbas-project.github.io/lolbas/OtherMSBinaries/WFMFormat/"],"count":1},{"id":"lolbas:wfc-exe","name":"Wfc.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\v10.0A\\bin\\NETFX 4.8 Tools\\wfc.exe"],"author":"Jimmy (@bohops)","created":"2021-09-26T00:00:00.000Z","contributors":["Matt Graeber @mattifestation","Jimmy @bohops"],"references":["https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/"],"count":1},{"id":"lolbas:windbg-exe","name":"WinDbg.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x64\\windbg.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\x86\\windbg.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm\\windbg.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Debuggers\\arm64\\windbg.exe"],"author":"Avihay Eldad","created":"2025-07-16T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/windbg-command-line-options","https://lolbas-project.github.io/lolbas/OtherMSBinaries/WinDbg/"],"count":1},{"id":"lolbas:winproj-exe","name":"WinProj.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft Office\\Office14\\WinProj.exe","C:\\Program Files\\Microsoft Office\\Office14\\WinProj.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\WinProj.exe","C:\\Program Files\\Microsoft Office\\Office15\\WinProj.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\WinProj.exe","C:\\Program Files\\Microsoft Office\\Office16\\WinProj.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office14\\WinProj.exe","C:\\Program Files\\Microsoft Office\\root\\Office14\\WinProj.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office15\\WinProj.exe","C:\\Program Files\\Microsoft Office\\root\\Office15\\WinProj.exe","C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\WinProj.exe","C:\\Program Files\\Microsoft Office\\root\\Office16\\WinProj.exe"],"author":"Avihay Eldad","created":"2024-02-14T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/WinProj/"],"count":1},{"id":"lolbas:winword-exe","name":"Winword.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Office\\root\\Office16\\winword.exe","C:\\Program Files (x86)\\Microsoft Office 16\\ClientX86\\Root\\Office16\\winword.exe","C:\\Program Files\\Microsoft Office 16\\ClientX64\\Root\\Office16\\winword.exe","C:\\Program Files (x86)\\Microsoft Office\\Office16\\winword.exe","C:\\Program Files\\Microsoft Office\\Office16\\winword.exe","C:\\Program Files (x86)\\Microsoft Office 15\\ClientX86\\Root\\Office15\\winword.exe","C:\\Program Files\\Microsoft Office 15\\ClientX64\\Root\\Office15\\winword.exe","C:\\Program Files (x86)\\Microsoft Office\\Office15\\winword.exe","C:\\Program Files\\Microsoft Office\\Office15\\winword.exe","C:\\Program Files (x86)\\Microsoft Office 14\\ClientX86\\Root\\Office14\\winword.exe","C:\\Program Files\\Microsoft Office 14\\ClientX64\\Root\\Office14\\winword.exe","C:\\Program Files (x86)\\Microsoft Office\\Office14\\winword.exe","C:\\Program Files\\Microsoft Office\\Office14\\winword.exe","C:\\Program Files (x86)\\Microsoft Office\\Office12\\winword.exe","C:\\Program Files\\Microsoft Office\\Office12\\winword.exe","C:\\Program Files\\Microsoft Office\\Office12\\winword.exe"],"author":"Reegun J (OCBC Bank)","created":"2019-07-19T00:00:00.000Z","contributors":["Reegun J (OCBC Bank) @reegun21"],"references":["https://twitter.com/reegun21/status/1150032506504151040","https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/"],"count":1},{"id":"lolbas:wsb-exe","name":"wsb.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<user>\\AppData\\Local\\Microsoft\\WindowsApps\\wsb.exe"],"author":"Konrad 'unrooted' Klawikowski","created":"2026-05-28T00:00:00.000Z","contributors":["Konrad 'unrooted' Klawikowski","Lloyd Davies @LloydLabs"],"references":["https://web.archive.org/web/20250116184008/http://blog.syscall.party/2020/12/02/weaponizing-windows-sandbox.html","https://github.com/LloydLabs/wsb-detect","https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli","https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versions","https://github.com/secdev02/SandBoxShenanigans","https://lolbas-project.github.io/lolbas/OtherMSBinaries/wsb/"],"count":3},{"id":"lolbas:wsl-exe","name":"Wsl.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Windows\\System32\\wsl.exe"],"author":"Matthew Brown","created":"2019-06-27T00:00:00.000Z","contributors":["Alex Ionescu @aionescu","Matt @NotoriousRebel1","Asif Matadar @d1r4c","Nasreddine Bencherchali @nas_bench","Konrad 'unrooted' Klawikowski","Liran Ravich, CardinalOps"],"references":["https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules","https://twitter.com/nas_bench/status/1535431474429808642","https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/"],"count":5},{"id":"lolbas:xbootmgr-exe","name":"XBootMgr.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgr.exe"],"author":"Avihay Eldad","created":"2025-07-10T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad","Tommy Warren"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference","https://lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgr/"],"count":2},{"id":"lolbas:xbootmgrsleep-exe","name":"XBootMgrSleep.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe","C:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\xbootmgrsleep.exe"],"author":"Avihay Eldad","created":"2024-06-13T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad","Yuval Saban @yuvalsaban3"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference","https://lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgrSleep/"],"count":1},{"id":"lolbas:devtunnel-exe","name":"devtunnel.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<username>\\AppData\\Local\\Temp\\.net\\devtunnel\\devtunnel.exe","C:\\Users\\<username>\\AppData\\Local\\Temp\\DevTunnels\\devtunnel.exe"],"author":"Kamran Saifullah","created":"2023-09-16T00:00:00.000Z","contributors":["Kamran Saifullah @deFr0ggy"],"references":["https://code.visualstudio.com/docs/editor/port-forwarding","https://lolbas-project.github.io/lolbas/OtherMSBinaries/devtunnel/"],"count":1},{"id":"lolbas:dotnet-counters-exe","name":"dotnet-counters.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<user>\\.dotnet\\tools\\dotnet-counters.exe"],"author":"Iván Cabrera","created":"2026-08-27T00:00:00.000Z","contributors":["Iván Cabrera @ivancabrera02"],"references":["https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-counters","https://github.com/dotnet/diagnostics","https://lolbas-project.github.io/lolbas/OtherMSBinaries/dotnet-counters/"],"count":1},{"id":"lolbas:dotnet-trace-exe","name":"dotnet-trace.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Users\\<user>\\.dotnet\\tools\\dotnet-trace.exe"],"author":"Iván Cabrera","created":"2026-08-27T00:00:00.000Z","contributors":["Iván Cabrera @ivancabrera02"],"references":["https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-trace","https://github.com/dotnet/diagnostics","https://lolbas-project.github.io/lolbas/OtherMSBinaries/dotnet-trace/"],"count":1},{"id":"lolbas:vsls-agent-exe","name":"vsls-agent.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["c:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Professional\\Common7\\IDE\\Extensions\\Microsoft\\LiveShare\\Agent\\vsls-agent.exe"],"author":"Jimmy (@bohops)","created":"2022-11-01T00:00:00.000Z","contributors":["Jimmy @bohops"],"references":["https://twitter.com/bohops/status/1583916360404729857","https://lolbas-project.github.io/lolbas/OtherMSBinaries/vsls-agent/"],"count":1},{"id":"lolbas:vstest-console-exe","name":"vstest.console.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe","C:\\Program Files (x86)\\Microsoft Visual Studio\\2022\\TestAgent\\Common7\\IDE\\CommonExtensions\\Microsoft\\TestWindow\\vstest.console.exe"],"author":"Onat Uzunyayla","created":"2023-09-08T00:00:00.000Z","contributors":["Onat Uzunyayla","Ayberk Halac"],"references":["https://learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022","https://lolbas-project.github.io/lolbas/OtherMSBinaries/vstest.console/"],"count":1},{"id":"lolbas:winfile-exe","name":"winfile.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Windows\\System32\\winfile.exe","C:\\Windows\\winfile.exe","C:\\Program Files\\WinFile\\winfile.exe","C:\\Program Files (x86)\\WinFile\\winfile.exe","C:\\Program Files\\WindowsApps\\Microsoft.WindowsFileManager_10.3.0.0_x64__8wekyb3d8bbwe\\WinFile\\winfile.exe"],"author":"Avihay Eldad","created":"2024-04-30T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://github.com/microsoft/winfile","https://lolbas-project.github.io/lolbas/OtherMSBinaries/winfile/"],"count":1},{"id":"lolbas:xsd-exe","name":"xsd.exe","source":"LOLBAS","platform":["Windows"],"toolType":"OtherMSBinary","aliases":[],"fullPath":["C:\\Program Files (x86)\\Microsoft SDKs\\Windows\\<version>\\bin\\NETFX <version> Tools\\xsd.exe"],"author":"Avihay Eldad","created":"2024-04-09T00:00:00.000Z","contributors":["Avihay Eldad @AvihayEldad"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/xsd/"],"count":1},{"id":"wadcoms:ADCSEnumaration","name":"ADCSEnumaration","source":"WADComs","platform":["Windows"],"references":["https://github.com/GhostPack/Certify","https://posts.specterops.io/certified-pre-owned-d95910965cd2","https://www.thehacker.recipes/ad/movement/adcs/"],"count":1},{"id":"wadcoms:BloodHound.py","name":"BloodHound.py","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/BloodHoundAD/BloodHound","https://github.com/fox-it/BloodHound.py"],"count":2},{"id":"wadcoms:CredDumpWithoutMimilkatz","name":"CredDumpWithoutMimilkatz","source":"WADComs","platform":["Windows","Linux"],"references":["https://www.ired.team/offensive-security/credential-access-and-credential-dumping","https://www.synacktiv.com/en/publications/lsa-secrets-revisiting-secretsdump"],"count":1},{"id":"wadcoms:Dementor","name":"Dementor","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc","https://www.praetorian.com/blog/active-directory-computer-account-smb-relaying-attack"],"count":1},{"id":"wadcoms:Enum4Linux","name":"Enum4Linux","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/CiscoCXSecurity/enum4linux","https://github.com/cddmp/enum4linux-ng"],"count":3},{"id":"wadcoms:Evil","name":"Evil","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/Hackplayers/evil-winrm","https://book.hacktricks.xyz/cryptography/certificates"],"count":3},{"id":"wadcoms:FindUncommonShares","name":"FindUncommonShares","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/p0dalirius/FindUncommonShares"],"count":1},{"id":"wadcoms:Impacket-dcomexec","name":"Impacket-dcomexec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py","https://riccardoancarani.github.io/2020-05-10-hunting-for-impacket/"],"count":1},{"id":"wadcoms:Impacket-Get-GPPPassword","name":"Impacket-Get-GPPPassword","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/Get-GPPPassword.py","https://podalirius.net/en/articles/exploiting-windows-group-policy-preferences/"],"count":1},{"id":"wadcoms:Impacket-GetADUsers","name":"Impacket-GetADUsers","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetADUsers.py"],"count":1},{"id":"wadcoms:Impacket-GetNPUsers","name":"Impacket-GetNPUsers","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetNPUsers.py","https://www.tarlogic.com/en/blog/how-to-attack-kerberos/"],"count":1},{"id":"wadcoms:Impacket-GetUserSPNs","name":"Impacket-GetUserSPNs","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/GetUserSPNs.py","https://www.tarlogic.com/en/blog/how-to-attack-kerberos/","https://github.com/fortra/impacket","https://swarm.ptsecurity.com/kerberoasting-without-spns/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast"],"count":2},{"id":"wadcoms:Impacket-ticketer","name":"Impacket-ticketer","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/ticketer.py","https://www.tarlogic.com/en/blog/how-to-attack-kerberos/","https://github.com/fortra/impacket","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket","https://attack.mitre.org/techniques/T1558/001/"],"count":3},{"id":"wadcoms:Impacket-lookupsid","name":"Impacket-lookupsid","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/lookupsid.py","https://www.puckiestyle.nl/impacket/"],"count":1},{"id":"wadcoms:Impacket-ntlmrelayx","name":"Impacket-ntlmrelayx","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/ntlmrelayx.py","https://www.praetorian.com/blog/active-directory-computer-account-smb-relaying-attack","https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/","https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py","https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota","https://www.thehacker.recipes/ad/movement/ntlm/relay","https://www.thehacker.recipes/ad/movement/credentials/dumping/laps","https://posts.specterops.io/certified-pre-owned-d95910965cd2","https://www.thehacker.recipes/ad/movement/adcs/relay","https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd","https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab","https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials"],"count":10},{"id":"wadcoms:Impacket-psexec","name":"Impacket-psexec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py","https://www.sans.org/blog/psexec-python-rocks/","https://book.hacktricks.xyz/windows/active-directory-methodology/pass-the-ticket#pass-the-ticket-attack"],"count":2},{"id":"wadcoms:Impacket-rbcd","name":"Impacket-rbcd","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/rbcd.py","https://github.com/tothi/rbcd-attack"],"count":1},{"id":"wadcoms:Impacket-rpcdump","name":"Impacket-rpcdump","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/rpcdump.py","https://www.hackingarticles.in/impacket-guide-smb-msrpc/"],"count":1},{"id":"wadcoms:Impacket-reg","name":"Impacket-reg","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/reg.py","https://www.hackingarticles.in/impacket-guide-smb-msrpc/"],"count":1},{"id":"wadcoms:Impacket-samrdump","name":"Impacket-samrdump","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/samrdump.py","https://www.hackingarticles.in/impacket-guide-smb-msrpc/"],"count":1},{"id":"wadcoms:Impacket-smbclient","name":"Impacket-smbclient","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbclient.py","https://www.hackingarticles.in/impacket-guide-smb-msrpc/"],"count":1},{"id":"wadcoms:Impacket-smbexec","name":"Impacket-smbexec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py","https://www.varonis.com/blog/insider-danger-stealthy-password-hacking-with-smbexec/"],"count":1},{"id":"wadcoms:Impacket-secretsdump","name":"Impacket-secretsdump","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py","https://riccardoancarani.github.io/2020-05-10-hunting-for-impacket/#secretsdumppy"],"count":2},{"id":"wadcoms:Impacket-services","name":"Impacket-services","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/services.py","https://www.hackingarticles.in/impacket-guide-smb-msrpc/"],"count":1},{"id":"wadcoms:Impacket-wmiexec","name":"Impacket-wmiexec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py","https://riccardoancarani.github.io/2020-05-10-hunting-for-impacket/#wmiexecpy"],"count":1},{"id":"wadcoms:Impacket-addcomputer","name":"Impacket-addcomputer","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/addcomputer.py","http://blog.redxorblue.com/2019/12/no-shells-required-using-impacket-to.html"],"count":2},{"id":"wadcoms:Impacket-atexec","name":"Impacket-atexec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py","https://u0041.co/blog/post/1"],"count":2},{"id":"wadcoms:Impacket-getST","name":"Impacket-getST","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py","http://blog.redxorblue.com/2019/12/no-shells-required-using-impacket-to.html"],"count":2},{"id":"wadcoms:Impacket-getTGT","name":"Impacket-getTGT","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/SecureAuthCorp/impacket/blob/master/examples/getTGT.py","https://www.tarlogic.com/en/blog/how-to-attack-kerberos/"],"count":1},{"id":"wadcoms:Kerbrute","name":"Kerbrute","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/ropnop/kerbrute"],"count":4},{"id":"wadcoms:LDAPSearch","name":"LDAPSearch","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://linux.die.net/man/1/ldapsearch"],"count":2},{"id":"wadcoms:Mitm6","name":"Mitm6","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/dirkjanm/mitm6","https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/"],"count":1},{"id":"wadcoms:NetExec","name":"NetExec","source":"WADComs","platform":["Linux","Windows","ActiveDirectory","macOS"],"references":["https://blog.redteam-pentesting.de/2025/windows-coercion/","https://github.com/Pennyw0rth/NetExec","https://www.netexec.wiki/smb-protocol/scan-for-vulnerabilities","https://www.netexec.wiki/","https://attack.mitre.org/techniques/T1558/004/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast","https://attack.mitre.org/techniques/T1558/003/","https://cybersecurity.bureauveritas.com/blog/timeroasting-attacking-trust-accounts-in-active-directory","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates","https://posts.specterops.io/certified-pre-owned-d95910965cd2","https://www.netexec.wiki/ldap-protocol/enumerate-machineaccountquota","https://attack.mitre.org/techniques/T1087/002/","https://www.netexec.wiki/mssql-protocol/command-execution","https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server","https://www.netexec.wiki/mssql-protocol/authentication","https://www.netexec.wiki/mssql-protocol/mssql-privesc","https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing","https://www.netexec.wiki/smb-protocol/obtaining-credentials/gpp-password","https://attack.mitre.org/techniques/T1552/006/","https://www.netexec.wiki/smb-protocol/obtaining-credentials/dump-keepass","https://www.netexec.wiki/smb-protocol/spidering-shares","https://www.netexec.wiki/smb-protocol/obtaining-credentials/veeam","https://www.netexec.wiki/getting-started/using-modules","https://www.netexec.wiki/getting-started/selecting-and-using-a-protocol"],"count":27},{"id":"wadcoms:Nmap","name":"Nmap","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://nmap.org/download.html","https://nmap.org/nsedoc/scripts/krb5-enum-users.html"],"count":1},{"id":"wadcoms:PKINIT","name":"PKINIT","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/dirkjanm/PKINITtools","https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/"],"count":2},{"id":"wadcoms:PSADmodule","name":"PSADmodule","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/samratashok/ADModule"],"count":1},{"id":"wadcoms:PetitPotam","name":"PetitPotam","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/topotam/PetitPotam","https://www.truesec.com/hub/blog/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory"],"count":1},{"id":"wadcoms:Powershell","name":"Powershell","source":"WADComs","platform":["Windows"],"references":["https://docs.microsoft.com/en-us/powershell/module/activedirectory/","https://github.com/samratashok/ADModule","https://www.labofapenetrationtester.com/2018/10/domain-enumeration-from-PowerShell-CLM.html"],"count":1},{"id":"wadcoms:PwshADmodule","name":"PwshADmodule","source":"WADComs","platform":["Windows"],"references":["https://redfoxsec.com/blog/attacking-kerberos-delegation/","https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html","https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/","https://github.com/samratashok/ADModule","https://docs.microsoft.com/en-us/powershell/module/activedirectory/"],"count":2},{"id":"wadcoms:PyLDAPmonitor","name":"PyLDAPmonitor","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/p0dalirius/LDAPmonitor/tree/master/python"],"count":1},{"id":"wadcoms:PyWhisker","name":"PyWhisker","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/shutdownrepo/pywhisker"],"count":1},{"id":"wadcoms:RPCClient","name":"RPCClient","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://www.samba.org/samba/docs/current/man-html/rpcclient.1.html","https://www.ired.team/offensive-security/enumeration-and-discovery/enumerating-windows-domains-using-rpcclient-through-socksproxy-bypassing-command-line-logging"],"count":1},{"id":"wadcoms:Regexe","name":"Regexe","source":"WADComs","platform":["Windows"],"references":["https://pentestlab.blog/2019/10/01/persistence-registry-run-keys/","https://www.hackingarticles.in/windows-persistence-using-winlogon/","https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/reg","https://docs.microsoft.com/en-us/windows-hardware/drivers/install/runonce-registry-key"],"count":1},{"id":"wadcoms:Responder","name":"Responder","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/lgandx/Responder","https://www.ivoidwarranties.tech/posts/pentesting-tuts/responder/cheatsheet/","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/llmnr-nbtns-mdns-spoofing","https://attack.mitre.org/techniques/T1557/001/"],"count":2},{"id":"wadcoms:Rubeus","name":"Rubeus","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/GhostPack/Rubeus","https://github.com/GhostPack/Rubeus#asreproast","https://github.com/GhostPack/Rubeus#asktgt","https://github.com/GhostPack/Rubeus#brute","https://github.com/GhostPack/Rubeus#kerberoast","https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/steal-or-forge-kerberos-tickets/constrained-delegation","https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-kerberos-constrained-delegation","https://www.thehacker.recipes/ad/movement/kerberos/ptt","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/diamond-ticket","https://www.thehacker.recipes/ad/movement/kerberos/forged-tickets/diamond","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket","https://attack.mitre.org/techniques/T1558/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/golden-ticket","https://attack.mitre.org/techniques/T1558/001/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/unconstrained-delegation"],"count":15},{"id":"wadcoms:SMBClient","name":"SMBClient","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://www.samba.org/samba/docs/current/man-html/smbclient.1.html","https://www.madirish.net/59"],"count":5},{"id":"wadcoms:SMBMap","name":"SMBMap","source":"WADComs","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/ShawnDEvans/smbmap","https://www.nopsec.com/blog/smbmap-wield-it-like-the-creator/"],"count":3},{"id":"wadcoms:SafetyKatz","name":"SafetyKatz","source":"WADComs","platform":["Windows"],"references":["https://github.com/GhostPack/SafetyKatz","https://www.harmj0y.net/blog/redteaming/ghostpack/"],"count":1},{"id":"wadcoms:Seatbelt","name":"Seatbelt","source":"WADComs","platform":["Windows"],"references":["https://github.com/GhostPack/Seatbelt","https://www.harmj0y.net/blog/redteaming/ghostpack/"],"count":1},{"id":"wadcoms:SharpDump","name":"SharpDump","source":"WADComs","platform":["Windows"],"references":["https://github.com/GhostPack/SharpDump","https://www.harmj0y.net/blog/redteaming/ghostpack/"],"count":1},{"id":"wadcoms:SharpHound","name":"SharpHound","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/BloodHoundAD/SharpHound3","https://bloodhound.readthedocs.io/en/latest/data-collection/sharphound.html","https://bloodhound.specterops.io/collect-data/ce-collection/sharphound","https://github.com/ZishanAdThandar/pentest/blob/main/notes/ActiveDirectory.md#bloodhound"],"count":2},{"id":"wadcoms:SharpLDAPmonitor","name":"SharpLDAPmonitor","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/p0dalirius/LDAPmonitor/tree/master/csharp"],"count":1},{"id":"wadcoms:SharpUp","name":"SharpUp","source":"WADComs","platform":["Windows"],"references":["https://github.com/GhostPack/SharpUp","https://www.harmj0y.net/blog/redteaming/ghostpack/"],"count":1},{"id":"wadcoms:SharpWMI","name":"SharpWMI","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/GhostPack/SharpWMI","https://www.harmj0y.net/blog/redteaming/ghostpack/"],"count":1},{"id":"wadcoms:Snaffler","name":"Snaffler","source":"WADComs","platform":["Windows","ActiveDirectory"],"references":["https://github.com/SnaffCon/Snaffler"],"count":1},{"id":"wadcoms:Windapsearch","name":"Windapsearch","source":"WADComs","platform":["Linux","Windows"],"references":["https://github.com/ropnop/windapsearch","https://www.attackdebris.com/?p=470"],"count":1},{"id":"wadcoms:bloodyAD","name":"bloodyAD","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/CravateRouge/bloodyAD","https://adminions.ca/books/active-directory-enumeration-and-exploitation/page/bloodyad","https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology","https://www.thehacker.recipes/ad/movement/dacl/grant-rights","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse","https://www.thehacker.recipes/ad/movement/dacl/addmember","https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation","https://www.thehacker.recipes/ad/movement/kerberos/asreproast","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast","https://www.thehacker.recipes/ad/movement/dacl/grant-ownership","https://www.thehacker.recipes/ad/movement/dacl/forcechangepassword","https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials","https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab"],"count":9},{"id":"wadcoms:lsassy","name":"lsassy","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://en.hackndo.com/remote-lsass-dump-passwords/","https://github.com/login-securite/lsassy?tab=readme-ov-file"],"count":1},{"id":"wadcoms:targetedKerberoast","name":"targetedKerberoast","source":"WADComs","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/ShutdownRepo/targetedKerberoast"],"count":1},{"id":"wadcoms:winPEAS","name":"winPEAS","source":"WADComs","platform":["Windows"],"references":["https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS","https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/winPEAS/winPEASexe/README.md","https://book.hacktricks.xyz/windows/windows-local-privilege-escalation"],"count":1},{"id":"wadcoms:adidnsdump","name":"adidnsdump","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/dirkjanm/adidnsdump","https://dirkjanm.io/getting-in-the-zone-dumping-active-directory-dns-with-adidnsdump/","https://attack.mitre.org/techniques/T1590/002/"],"count":1},{"id":"wadcoms:Certify","name":"Certify","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/GhostPack/Certify","https://posts.specterops.io/certified-pre-owned-d95910965cd2","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation"],"count":1},{"id":"wadcoms:Certipy","name":"Certipy","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows","macOS"],"references":["https://github.com/ly4k/Certipy","https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-and-some-thoughts-on-mitigations-c9d38edc7723","https://www.thehacker.recipes/ad/movement/adcs","https://posts.specterops.io/certified-pre-owned-d95910965cd2","https://www.thehacker.recipes/ad/movement/kerberos/pkinit","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation","https://www.thehacker.recipes/ad/movement/adcs/access-controls","https://www.thehacker.recipes/ad/movement/adcs/certificate-templates","https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab","https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials","https://github.com/ly4k/Certipy/wiki/08-%E2%80%90-Command-Reference","https://github.com/ly4k/Certipy/wiki"],"count":14},{"id":"wadcoms:Coercer","name":"Coercer","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/p0dalirius/Coercer","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/","https://podalirius.net/en/articles/coercer-an-automatic-authentication-coercion-tool/"],"count":2},{"id":"wadcoms:Comsvcs","name":"Comsvcs","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://lolbas-project.github.io/lolbas/Libraries/comsvcs/","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1003/001/"],"count":1},{"id":"wadcoms:CVE","name":"CVE","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/Bdenneu/CVE-2022-33679","https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html","https://horizon3.ai/attack-research/attack-blogs/from-cve-2022-33679-to-unauthenticated-kerberoasting/"],"count":1},{"id":"wadcoms:DFSCoerce","name":"DFSCoerce","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/Wh04m1001/DFSCoerce","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-dfsnm"],"count":1},{"id":"wadcoms:DonPAPI","name":"DonPAPI","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/login-securite/DonPAPI","https://www.login-securite.com/2022/03/28/donpapi/"],"count":1},{"id":"wadcoms:EfsPotato","name":"EfsPotato","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/zcgonvh/EfsPotato","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"],"count":1},{"id":"wadcoms:GodPotato","name":"GodPotato","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/BeichenDream/GodPotato","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato","https://attack.mitre.org/techniques/T1134/002/"],"count":1},{"id":"wadcoms:Hashcat","name":"Hashcat","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://hashcat.net/wiki/doku.php?id=example_hashes","https://www.thehacker.recipes/ad/movement/kerberos/asreproast","https://attack.mitre.org/techniques/T1558/004/","https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz","https://attack.mitre.org/techniques/T1003/005/","https://www.thehacker.recipes/ad/movement/kerberos/kerberoast","https://attack.mitre.org/techniques/T1558/003/","https://github.com/evilmog/ntlmv1-multi","https://crack.sh/netntlm/","https://www.thehacker.recipes/ad/movement/ntlm/capture","https://attack.mitre.org/techniques/T1110/002/","https://github.com/fortra/impacket/blob/master/examples/secretsdump.py","https://attack.mitre.org/techniques/T1003/002/"],"count":6},{"id":"wadcoms:Impacket-dacledit","name":"Impacket-dacledit","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://www.thehacker.recipes/ad/movement/dacl/grant-rights","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"],"count":1},{"id":"wadcoms:Impacket-describeTicket","name":"Impacket-describeTicket","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://www.thehacker.recipes/ad/movement/kerberos/ptt"],"count":1},{"id":"wadcoms:Impacket-findDelegation","name":"Impacket-findDelegation","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://www.thehacker.recipes/ad/movement/kerberos/delegations","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/constrained-delegation"],"count":1},{"id":"wadcoms:Impacket-goldenPac","name":"Impacket-goldenPac","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://github.com/fortra/impacket/blob/master/examples/goldenPac.py","https://attack.mitre.org/techniques/T1558/"],"count":1},{"id":"wadcoms:Impacket-mssqlclient","name":"Impacket-mssqlclient","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server","https://www.thehacker.recipes/ad/movement/mssql","https://www.thehacker.recipes/ad/movement/mssql/execution"],"count":2},{"id":"wadcoms:Impacket-owneredit","name":"Impacket-owneredit","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://www.thehacker.recipes/ad/movement/dacl/grant-ownership","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/acl-persistence-abuse"],"count":1},{"id":"wadcoms:Impacket-raiseChild","name":"Impacket-raiseChild","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://www.thehacker.recipes/ad/movement/domain-trusts/child-parent","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/sid-history-injection"],"count":1},{"id":"wadcoms:Impacket-ticketConverter","name":"Impacket-ticketConverter","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/fortra/impacket","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket","https://www.thehacker.recipes/ad/movement/kerberos/ptt"],"count":1},{"id":"wadcoms:John","name":"John","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/openwall/john","https://hashcat.net/wiki/doku.php?id=example_hashes","https://attack.mitre.org/techniques/T1555/005/","https://www.thehacker.recipes/ad/movement/kerberos/pass-the-certificate","https://attack.mitre.org/techniques/T1110/002/"],"count":2},{"id":"wadcoms:JuicyPotatoNG","name":"JuicyPotatoNG","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/antonioCoco/JuicyPotatoNG","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/juicypotato"],"count":1},{"id":"wadcoms:Krbrelayx","name":"Krbrelayx","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/dirkjanm/krbrelayx","https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/","https://www.thehacker.recipes/ad/movement/kerberos/delegations/unconstrained"],"count":1},{"id":"wadcoms:LaZagne","name":"LaZagne","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/AlessandroZ/LaZagne","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1555/"],"count":1},{"id":"wadcoms:ldapdomaindump","name":"ldapdomaindump","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/dirkjanm/ldapdomaindump","https://book.hacktricks.xyz/network-services-pentesting/pentesting-ldap","https://attack.mitre.org/techniques/T1087/002/"],"count":1},{"id":"wadcoms:ldapnomnom","name":"ldapnomnom","source":"DAEMON","platform":["Linux","Windows","ActiveDirectory"],"references":["https://github.com/lkarlslund/ldapnomnom","https://attack.mitre.org/techniques/T1087/002/"],"count":1},{"id":"wadcoms:ldeep","name":"ldeep","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/franc-pentest/ldeep","https://www.hackingarticles.in/active-directory-enumeration-ldeep/","https://attack.mitre.org/techniques/T1087/002/"],"count":1},{"id":"wadcoms:MANSPIDER","name":"MANSPIDER","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/blacklanternsecurity/MANSPIDER","https://www.blacklanternsecurity.com/2020-11-04-MANSPIDER/"],"count":1},{"id":"wadcoms:Mimikatz","name":"Mimikatz","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/gentilkiwi/mimikatz","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates","https://attack.mitre.org/techniques/T1552/004/","https://www.dcshadow.com/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcshadow","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dcsync","https://attack.mitre.org/techniques/T1003/006/","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords","https://attack.mitre.org/techniques/T1555/004/","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1003/001/","https://book.hacktricks.xyz/windows-hardening/stealing-credentials/credentials-mimikatz","https://attack.mitre.org/techniques/T1003/002/","https://attack.mitre.org/techniques/T1003/004/","https://book.hacktricks.xyz/windows-hardening/ntlm/pass-the-hash","https://attack.mitre.org/techniques/T1550/002/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/pass-the-ticket","https://attack.mitre.org/techniques/T1550/003/","https://adsecurity.org/?p=1275","https://attack.mitre.org/techniques/T1556/001/"],"count":10},{"id":"wadcoms:Nanodump","name":"Nanodump","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/fortra/nanodump","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1003/001/"],"count":1},{"id":"wadcoms:Nltest","name":"Nltest","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)","https://attack.mitre.org/techniques/T1482/","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"],"count":1},{"id":"wadcoms:noPac","name":"noPac","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/Ridter/noPac","https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"],"count":2},{"id":"wadcoms:PowerMad","name":"PowerMad","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/Kevin-Robertson/Powermad","https://www.thehacker.recipes/ad/movement/domain-settings/machineaccountquota","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/resource-based-constrained-delegation"],"count":1},{"id":"wadcoms:PowerUpSQL","name":"PowerUpSQL","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/NetSPI/PowerUpSQL","https://www.netspi.com/blog/technical-blog/network-penetration-testing/how-to-hack-database-links-in-sql-server/","https://book.hacktricks.xyz/network-services-pentesting/pentesting-mssql-microsoft-sql-server","https://www.netspi.com/blog/technical-blog/network-penetration-testing/finding-sensitive-data-domain-sql-servers-powerupsql/","https://www.netspi.com/blog/technical-blog/network-penetration-testing/establishing-registry-persistence-via-sql-server-powerupsql/"],"count":3},{"id":"wadcoms:PowerView","name":"PowerView","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/PowerShellMafia/PowerSploit","https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993","https://www.thehacker.recipes/ad/movement/dacl/","https://www.thehacker.recipes/ad/movement/dacl/grant-rights.html","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology","https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e","https://wald0.com/?p=112","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/kerberoast"],"count":11},{"id":"wadcoms:pre2k","name":"pre2k","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/garrettfoster13/pre2k","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"],"count":2},{"id":"wadcoms:PrinterBug","name":"PrinterBug","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/dirkjanm/krbrelayx","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn"],"count":1},{"id":"wadcoms:PrintSpoofer","name":"PrintSpoofer","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/itm4n/PrintSpoofer","https://itm4n.github.io/printspoofer-abusing-impersonation-privileges/","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"],"count":1},{"id":"wadcoms:Procdump","name":"Procdump","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://learn.microsoft.com/en-us/sysinternals/downloads/procdump","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1003/001/"],"count":1},{"id":"wadcoms:pyGPOAbuse","name":"pyGPOAbuse","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/Hackndo/pyGPOAbuse","https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e","https://attack.mitre.org/techniques/T1484/001/"],"count":1},{"id":"wadcoms:Pypykatz","name":"Pypykatz","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/skelsec/pypykatz","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1003/001/"],"count":1},{"id":"wadcoms:RoguePotato","name":"RoguePotato","source":"DAEMON","platform":["Windows","Linux","ActiveDirectory"],"references":["https://github.com/antonioCoco/RoguePotato","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"],"count":1},{"id":"wadcoms:sam","name":"sam","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/WazeHell/sam-the-admin","https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing"],"count":1},{"id":"wadcoms:ShadowCoerce","name":"ShadowCoerce","source":"DAEMON","platform":["Linux","ActiveDirectory","Windows"],"references":["https://github.com/ShutdownRepo/ShadowCoerce","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-fsrvp"],"count":1},{"id":"wadcoms:SharpChrome","name":"SharpChrome","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/GhostPack/SharpDPAPI","https://book.hacktricks.xyz/windows-hardening/stealing-credentials","https://attack.mitre.org/techniques/T1555/003/"],"count":1},{"id":"wadcoms:SharpDPAPI","name":"SharpDPAPI","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/GhostPack/SharpDPAPI","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords","https://attack.mitre.org/techniques/T1555/004/"],"count":1},{"id":"wadcoms:SharpGPOAbuse","name":"SharpGPOAbuse","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/FSecureLABS/SharpGPOAbuse","https://posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e","https://attack.mitre.org/techniques/T1484/001/"],"count":2},{"id":"wadcoms:SharpView","name":"SharpView","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/tevora-threat/SharpView","https://github.com/PowerShellMafia/PowerSploit","https://book.hacktricks.xyz/windows-hardening/active-directory-methodology"],"count":1},{"id":"wadcoms:SpoolSample","name":"SpoolSample","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/leechristensen/SpoolSample","https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn"],"count":1},{"id":"wadcoms:SweetPotato","name":"SweetPotato","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/CCob/SweetPotato","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer"],"count":1},{"id":"wadcoms:Whisker","name":"Whisker","source":"DAEMON","platform":["Windows","ActiveDirectory"],"references":["https://github.com/eladshamir/Whisker","https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials","https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab"],"count":1},{"id":"daemon:kubectl","name":"kubectl","source":"DAEMON","platform":["Linux","Windows","macOS"],"references":["https://attack.mitre.org/techniques/T1609/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_exec/","https://attack.mitre.org/techniques/T1552/007/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.007/T1552.007.md","https://kubernetes.io/docs/concepts/configuration/secret/","https://attack.mitre.org/techniques/T1611/","https://cloud.hacktricks.wiki/en/pentesting-cloud/kubernetes-security/attacking-kubernetes-from-inside-a-pod.html","https://kubernetes.io/docs/tasks/debug/debug-cluster/kubectl-node-debug/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_debug/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_cp/","https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access","https://detection.fyi/sigmahq/sigma/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing/","https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#port-forward","https://attack.mitre.org/techniques/T1090/001/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_create/kubectl_create_token/","https://attack.mitre.org/techniques/T1528/","https://attack.mitre.org/techniques/T1613/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_get/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_config/kubectl_config_current-context/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_config/kubectl_config_get-contexts/","https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/"],"count":13},{"id":"daemon:crictl","name":"crictl","source":"DAEMON","platform":["Linux"],"references":["https://kubernetes.io/docs/tasks/debug/debug-cluster/crictl/","https://attack.mitre.org/techniques/T1609/","https://attack.mitre.org/techniques/T1552/007/"],"count":2},{"id":"daemon:ctr","name":"ctr","source":"DAEMON","platform":["Linux"],"references":["https://hacktricks.wiki/en/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation.html","https://attack.mitre.org/techniques/T1611/"],"count":1},{"id":"daemon:runc","name":"runc","source":"DAEMON","platform":["Linux"],"references":["https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation","https://attack.mitre.org/techniques/T1611/"],"count":1},{"id":"daemon:docker","name":"docker","source":"DAEMON","platform":["Linux"],"references":["https://docs.docker.com/reference/cli/docker/container/export/","https://docs.docker.com/reference/cli/docker/image/save/","https://attack.mitre.org/techniques/T1005/"],"count":1},{"id":"daemon:nerdctl","name":"nerdctl","source":"DAEMON","platform":["Linux"],"references":["https://github.com/containerd/nerdctl/blob/main/docs/command-reference.md","https://attack.mitre.org/techniques/T1611/"],"count":1},{"id":"daemon:msiexec","name":"msiexec.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Msiexec.yml","https://attack.mitre.org/techniques/T1218/007/"],"count":1},{"id":"daemon:curl","name":"curl.exe","source":"DAEMON","platform":["Windows","Linux","macOS"],"references":["https://curl.se/docs/manpage.html","https://curl.se/windows/"],"count":1},{"id":"daemon:tar","name":"tar.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Tar.yml","https://learn.microsoft.com/en-us/windows/tar/"],"count":1},{"id":"daemon:ssh","name":"ssh.exe","source":"DAEMON","platform":["Windows","Linux","macOS"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Ssh.yml","https://attack.mitre.org/techniques/T1202/"],"count":1},{"id":"daemon:scp","name":"scp.exe","source":"DAEMON","platform":["Windows","Linux","macOS"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Scp.yml","https://attack.mitre.org/techniques/T1202/"],"count":1},{"id":"daemon:msedge","name":"msedge.exe","source":"DAEMON","platform":["Windows","macOS","Linux"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Msedge.yml","https://twitter.com/mrd0x/status/1478234484881436672"],"count":1},{"id":"daemon:mpcmdrun","name":"MpCmdRun.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/MpCmdRun.yml","https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/"],"count":1},{"id":"daemon:desktopimgdownldr","name":"desktopimgdownldr.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Desktopimgdownldr.yml","https://www.sentinelone.com/labs/living-off-windows-land-a-new-native-file-downldr/"],"count":1},{"id":"daemon:appinstaller","name":"AppInstaller.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/AppInstaller.yml","https://attack.mitre.org/techniques/T1105/"],"count":1},{"id":"daemon:onedrivestandaloneupdater","name":"OneDriveStandaloneUpdater.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/OneDriveStandaloneUpdater.yml","https://attack.mitre.org/techniques/T1105/"],"count":1},{"id":"daemon:finger","name":"finger.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Finger.yml","https://attack.mitre.org/techniques/T1105/"],"count":1},{"id":"daemon:wsl","name":"wsl.exe","source":"DAEMON","platform":["Windows","Linux"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Wsl.yml","https://attack.mitre.org/techniques/T1202/"],"count":1},{"id":"daemon:winget","name":"winget.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Winget.yml","https://learn.microsoft.com/en-us/windows/package-manager/winget/install"],"count":1},{"id":"daemon:devtunnel","name":"devtunnel.exe","source":"DAEMON","platform":["Windows","Linux","macOS"],"references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/devtunnels/","https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/cli-commands"],"count":1},{"id":"daemon:teams","name":"Teams.exe","source":"DAEMON","platform":["Windows","macOS","Linux"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Teams.yml","https://attack.mitre.org/techniques/T1218/015/"],"count":1},{"id":"daemon:diskshadow","name":"diskshadow.exe","source":"DAEMON","platform":["Windows"],"references":["https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Diskshadow.yml","https://attack.mitre.org/techniques/T1003/003/"],"count":1},{"id":"daemon:wevtutil","name":"wevtutil.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1070/001/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil","https://attack.mitre.org/techniques/T1562/002/"],"count":2},{"id":"daemon:powershell","name":"Clear-EventLog","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1070/001/","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/clear-eventlog","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/remove-eventlog?view=powershell-5.1","https://attack.mitre.org/techniques/T1070/006/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.006/T1070.006.md","https://attack.mitre.org/techniques/T1562/001/","https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference","https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference","https://attack.mitre.org/techniques/T1070/003/","https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.003/T1070.003.md"],"count":6},{"id":"daemon:auditpol","name":"auditpol.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1562/002/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol"],"count":1},{"id":"daemon:fsutil","name":"fsutil.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1070/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn"],"count":1},{"id":"daemon:attrib","name":"attrib.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1564/001/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/attrib"],"count":1},{"id":"daemon:reg","name":"reg.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1562/001/","https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware"],"count":1},{"id":"daemon:netsh","name":"netsh.exe","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1562/004/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netsh-advfirewall"],"count":1},{"id":"daemon:byovd","name":"BYOVD (vulnerable driver)","source":"DAEMON","platform":["Windows"],"references":["https://attack.mitre.org/techniques/T1068/","https://www.loldrivers.io/"],"count":1},{"id":"loobins:GetFileInfo","name":"GetFileInfo","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/GetFileInfo.yml","https://macosbin.com/bin/getfileinfo"],"count":1},{"id":"loobins:SetFile","name":"SetFile","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/SetFile.yml","https://daringfireball.net/2008/04/the_invisible_bit"],"count":2},{"id":"loobins:caffeinate","name":"caffeinate","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/caffeinate.yml","https://macosbin.com/bin/caffeinate","https://ss64.com/osx/caffeinate.html"],"count":2},{"id":"loobins:chflags","name":"chflags","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/chflags.yml","https://ss64.com/mac/chflags.html","https://macosbin.com/bin/chflags","https://eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/"],"count":2},{"id":"loobins:codesign","name":"codesign","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/codesign.yml","https://www.sentinelone.com/blog/when-apple-admits-macos-malware-is-a-problem-its-time-to-take-notice/","https://ss64.com/mac/codesign.html"],"count":1},{"id":"loobins:csrutil","name":"csrutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/csrutil.yml","https://developer.apple.com/forums/thread/4002","https://attack.mitre.org/techniques/T1518/001/","https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"],"count":5},{"id":"loobins:defaults","name":"defaults","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/defaults.yml","https://macos-defaults.com/","https://www.huntress.com/blog/insistence-on-persistence"],"count":6},{"id":"loobins:disown","name":"disown","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/disown.yml","https://linux.die.net/man/1/disown","https://man7.org/linux/man-pages/man1/bash.1.html","https://www.esentire.com/blog/poseidon-stealer-uses-sora-ai-lure-to-infect-macos"],"count":1},{"id":"loobins:ditto","name":"ditto","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ditto.yml","https://ss64.com/osx/ditto.html","https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/","https://www.jamf.com/blog/jamf-threat-labs-safari-vuln-gatekeeper-bypass/"],"count":4},{"id":"loobins:dns-sd","name":"dns-sd","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dns-sd.yml","https://themittenmac.com/what-does-apt-activity-look-like-on-macos","https://jonathanmumm.com/tech-it/mdns-bonjour-bible-common-service-strings-for-various-vendors/"],"count":4},{"id":"loobins:dscacheutil","name":"dscacheutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscacheutil.yml","https://macosbin.com/bin/dscacheutil","https://ss64.com/osx/dscacheutil.html"],"count":2},{"id":"loobins:dscl","name":"dscl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml","https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming","https://attack.mitre.org/techniques/T1136/001/"],"count":13},{"id":"loobins:dsconfigad","name":"dsconfigad","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsconfigad.yml","https://macosbin.com/bin/dsconfigad","https://www.unix.com/man-page/osx/8/dsconfigad/"],"count":2},{"id":"loobins:dsexport","name":"dsexport","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dsexport.yml"],"count":2},{"id":"loobins:funzip","name":"funzip","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/funzip.yml","https://www.uptycs.com/blog/threat-research-report-team/macos-bashed-apples-of-shlayer-and-bundlore","https://linux.die.net/man/1/funzip"],"count":1},{"id":"loobins:hdiutil","name":"hdiutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/hdiutil.yml","https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/"],"count":6},{"id":"loobins:ioreg","name":"ioreg","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml","https://evasions.checkpoint.com/src/MacOS/macos.html","https://github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520"],"count":4},{"id":"loobins:kextstat","name":"kextstat","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/kextstat.yml","https://ss64.com/osx/kextstat.html"],"count":1},{"id":"loobins:last","name":"last","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/last.yml","https://ss64.com/osx/last.html"],"count":3},{"id":"loobins:launchctl","name":"launchctl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/launchctl.yml","https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/","https://attack.mitre.org/techniques/T1569/001/","https://attack.mitre.org/techniques/T1543/001/","https://unit42.paloaltonetworks.com/unit42-sofacys-komplex-os-x-trojan/"],"count":2},{"id":"loobins:log","name":"log","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/log.yml","https://shellcromancer.io/posts/living-off-of-macos/"],"count":2},{"id":"loobins:lsregister","name":"lsregister","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/lsregister.yml","https://www.jamf.com/blog/remote-mac-exploitation-via-custom-url-schemes/","https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation"],"count":3},{"id":"loobins:mdfind","name":"mdfind","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdfind.yml","https://youtu.be/Snwh4mMe-Cg?t=45","https://www.jamf.com/blog/zero-day-tcc-bypass-discovered-in-xcsset-malware/"],"count":3},{"id":"loobins:mdls","name":"mdls","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mdls.yml","https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"],"count":3},{"id":"loobins:mktemp","name":"mktemp","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/mktemp.yml","https://www.jamf.com/blog/shlayer-malware-abusing-gatekeeper-bypass-on-macos/","https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"],"count":2},{"id":"loobins:networksetup","name":"networksetup","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/networksetup.yml","https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf","https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be","https://objective-see.org/blog/blog_0x25.html","https://objective-see.org/blog/blog_0x26.html","https://objective-see.org/blog/blog_0x6D.html","https://objective-see.org/blog/blog_0x3C.html","https://objective-see.org/blog/blog_0x6E.html"],"count":11},{"id":"loobins:notifyutil","name":"notifyutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/notifyutil.yml","https://brettterpstra.com/2012/07/04/quick-tip-system-wide-notifications-with-notifyutil/","https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/MacOSXNotifcationOv/DarwinNotificationConcepts/DarwinNotificationConcepts.html","https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/notify.3.html"],"count":6},{"id":"loobins:nscurl","name":"nscurl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nscurl.yml","https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl","https://danielcortez.substack.com/p/living-off-the-land-exploring-macos"],"count":3},{"id":"loobins:nvram","name":"nvram","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/nvram.yml","https://ss64.com/osx/nvram.html"],"count":1},{"id":"loobins:odutil","name":"odutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/odutil.yml","https://macosbin.com/bin/odutil","https://www.unix.com/man-page/osx/1/odutil/"],"count":4},{"id":"loobins:open","name":"open","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/open.yml","https://scriptingosx.com/2017/02/the-macos-open-command/"],"count":2},{"id":"loobins:osacompile","name":"osacompile","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osacompile.yml","https://redcanary.com/blog/mac-application-bundles/"],"count":1},{"id":"loobins:osascript","name":"osascript","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/osascript.yml","https://medium.com/red-teaming-with-a-blue-team-mentality/using-macos-internals-for-post-exploitation-b5faaa11e121","https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"],"count":9},{"id":"loobins:pbpaste","name":"pbpaste","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pbpaste.yml","https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b","https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-b65"],"count":1},{"id":"loobins:pkill","name":"pkill","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/pkill.yml","https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer","https://ss64.com/mac/pkill.html"],"count":5},{"id":"loobins:plutil","name":"plutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/plutil.yml","https://scriptingosx.com/2016/11/editing-property-lists/","https://attack.mitre.org/techniques/T1647/"],"count":1},{"id":"loobins:profiles","name":"profiles","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/profiles.yml","https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-mdm"],"count":2},{"id":"loobins:safaridriver","name":"safaridriver","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/safaridriver.yml","https://developer.apple.com/documentation/webkit/about_webdriver_for_safari","https://starlabs.sg/blog/2021/04-you-talking-to-me/"],"count":1},{"id":"loobins:say","name":"say","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/say.yml","https://ss64.com/osx/say.html"],"count":2},{"id":"loobins:screencapture","name":"screencapture","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/screencapture.yml","https://ss64.com/osx/screencapture.html"],"count":1},{"id":"loobins:scutil","name":"scutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/scutil.yml","https://macosbin.com/bin/scutil","https://ss64.com/osx/scutil.html"],"count":4},{"id":"loobins:security","name":"security","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/security.yml","https://www.netmeister.org/blog/keychain-passwords.html","https://ss64.com/osx/security.html"],"count":3},{"id":"loobins:sfltool","name":"sfltool","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sfltool.yml","https://www.unix.com/man-page/mojave/1/sfltool/","https://eclecticlight.co/2023/02/15/controlling-login-and-background-items-in-ventura/"],"count":2},{"id":"loobins:sharing","name":"sharing","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sharing.yml","https://ss64.com/mac/sharing.html","https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"],"count":1},{"id":"loobins:snmptrap","name":"snmptrap","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/snmptrap.yml","https://net-snmp.sourceforge.io/","https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"],"count":1},{"id":"loobins:softwareupdate","name":"softwareupdate","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/softwareupdate.yml","https://ss64.com/osx/softwareupdate.html"],"count":2},{"id":"loobins:spctl","name":"spctl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/spctl.yml","https://disable-gatekeeper.github.io/"],"count":1},{"id":"loobins:sqlite3","name":"sqlite3","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sqlite3.yml","https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh","https://redcanary.com/blog/clipping-silver-sparrows-wings/"],"count":3},{"id":"loobins:ssh-keygen","name":"ssh-keygen","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ssh-keygen.yml","https://medium.com/@D00MFist/generate-keys-or-generate-dylib-loads-c99ed48f323d"],"count":1},{"id":"loobins:streamzip","name":"streamzip","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/streamzip.yml","https://docs.oracle.com/cd/E88353_01/html/E37839/streamzip-1.html"],"count":1},{"id":"loobins:sw_vers","name":"sw_vers","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sw_vers.yml","https://macosbin.com/bin/sw_vers","https://ss64.com/osx/sw_vers.html"],"count":4},{"id":"loobins:swift","name":"swift","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/swift.yml","https://developer.apple.com/swift/blog/?id=18","https://jblevins.org/log/swift","https://krakendev.io/blog/scripting-in-swift","https://blog.eidinger.info/swift-e-runs-code-directly-from-the-command-line","https://ed.com/command-line-swift/"],"count":3},{"id":"loobins:sysadminctl","name":"sysadminctl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml","https://ss64.com/mac/sysadminctl.html"],"count":7},{"id":"loobins:sysctl","name":"sysctl","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysctl.yml","https://evasions.checkpoint.com/src/MacOS/macos.html"],"count":1},{"id":"loobins:system_profiler","name":"system_profiler","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml","https://macosbin.com/bin/system_profiler","https://ss64.com/osx/system_profiler.html"],"count":5},{"id":"loobins:systemsetup","name":"systemsetup","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/systemsetup.yml","https://ss64.com/osx/systemsetup.html"],"count":2},{"id":"loobins:tccutil","name":"tccutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tccutil.yml","https://ss64.com/mac/tccutil.html","https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/"],"count":2},{"id":"loobins:tclsh","name":"tclsh","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tclsh.yml","https://medium.com/specter-ops-posts/dylib-loads-that-tickle-your-fancy-d25196addd8c"],"count":1},{"id":"loobins:textutil","name":"textutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/textutil.yml","https://osxdaily.com/tag/textutil/"],"count":2},{"id":"loobins:tftp","name":"tftp","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tftp.yml","https://ss64.com/mac/tftp.html","https://en.wikipedia.org/https://hackviser.com/tactics/pentesting/services/tftp","https://www.stamus-networks.com/blog/uncovered-uncovering-risk-exposure-from-publicly-accessible-unauthenticated-tftp","https://attack.mitre.org/techniques/T1105/","https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/"],"count":3},{"id":"loobins:tmutil","name":"tmutil","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/tmutil.yml","https://theevilbit.github.io/posts/cve_2020_9771/","https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html","https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd"],"count":5},{"id":"loobins:xattr","name":"xattr","source":"LOOBins","platform":["macOS"],"references":["https://github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/xattr.yml","https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf","https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be"],"count":2},{"id":"daemon:aws","name":"aws","source":"DAEMON","platform":["Linux","Windows","macOS"],"references":["https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html","https://docs.aws.amazon.com/cli/latest/reference/configure/list.html","https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-regions.html"],"count":3},{"id":"daemon:az","name":"az","source":"DAEMON","platform":["Linux","Windows","macOS"],"references":["https://learn.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest#az-account-show","https://learn.microsoft.com/en-us/cli/azure/account?view=azure-cli-latest#az-account-list"],"count":2},{"id":"daemon:gcloud","name":"gcloud","source":"DAEMON","platform":["Linux","Windows","macOS"],"references":["https://cloud.google.com/sdk/gcloud/reference/projects/list","https://cloud.google.com/sdk/gcloud/reference/config/list","https://cloud.google.com/sdk/gcloud/reference/projects/get-iam-policy"],"count":3}]
	daemon-sec-lotl DÆMONBins: GTFOBins × LOLBAS × WADComs × LOOBins in one filterable catalog
	git clone https://git.daemon-sec.xyz/daemon-sec-lotl.git
	Log \| Files \| Refs \| Submodules \| README \| LICENSE