api0cradle/LOLBAS resource

Health v2 · maintenance only

Flags: no_releases archived no_license

Adoption not part of the score

1613 stars · 344 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated knowledge base documenting Windows binaries, scripts, and libraries that can be abused for 'Living Off The Land' attack techniques such as code execution, file downloads, UAC bypass, and persistence. Each entry has its own markdown file describing usage examples for red, blue, and purple team work.

Use cases

• find lolbins that can download files on a windows host
• identify binaries attackers can abuse for persistence
• build detection rules for living-off-the-land techniques
• research uac bypass techniques using built-in windows binaries
• check if a binary can be used for defense evasion
• purple team exercise reference for attack techniques

When to choose

• you need a reference catalog of abusable native Windows binaries and scripts
• you are writing detection rules or doing threat hunting for LOLBin abuse
• you run red or purple team exercises and need technique examples

When to avoid

• you need the actively updated version - use the LOLAS-Project/LOLBAS repo and web portal instead
• you want an automated scanning or detection tool rather than documentation
• you need coverage for Linux or macOS binaries

Facets

dataset · maturity maintenance

security penetration-testing vulnerability-scanning developer-tools security penetration-testing osint windows developer-tools windows cli self-hosted lolbins red-team blue-team dfir threat-hunting knowledge-base living-off-the-land archived-repo

Member repositories

For agents

markdown · JSON · MCP: product_card(name="api0cradle/LOLBAS")