# api0cradle/LOLBAS

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Repository: https://github.com/api0cradle/LOLBAS
Canonical: https://ross.abutalabs.com/products/api0cradle-lolbas
Language: XSLT
License Family: other
Topics: lolbins, lolscripts, redteam, blueteam, purpleteam, dfir, living-off-the-land
Archived: true
Last push: 2018-12-10T17:33:15+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3059, "days_push": 2823, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1613, forks 344 (observed 2026-08-28T04:05:11.172091+00:00)

## What it is
A curated knowledge base documenting Windows binaries, scripts, and libraries that can be abused for 'Living Off The Land' attack techniques such as code execution, file downloads, UAC bypass, and persistence. Each entry has its own markdown file describing usage examples for red, blue, and purple team work.

## Use cases
- find lolbins that can download files on a windows host
- identify binaries attackers can abuse for persistence
- build detection rules for living-off-the-land techniques
- research uac bypass techniques using built-in windows binaries
- check if a binary can be used for defense evasion
- purple team exercise reference for attack techniques

## When to choose
- you need a reference catalog of abusable native Windows binaries and scripts
- you are writing detection rules or doing threat hunting for LOLBin abuse
- you run red or purple team exercises and need technique examples

## When to avoid
- you need the actively updated version - use the LOLAS-Project/LOLBAS repo and web portal instead
- you want an automated scanning or detection tool rather than documentation
- you need coverage for Linux or macOS binaries

## Facets
- artifact type: dataset
- maturity: maintenance
- function: security, penetration-testing, vulnerability-scanning, developer-tools
- domain: security, penetration-testing, osint, windows, developer-tools
- platform: windows, cli, self-hosted
- tags: lolbins, red-team, blue-team, dfir, threat-hunting, knowledge-base, living-off-the-land, archived-repo

## Member repositories
- api0cradle/LOLBAS (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:11.172091+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:51:05.362030+00:00, confidence not recorded.
  - readme: https://github.com/api0cradle/LOLBAS (fetched 2026-08-28T04:05:11.172091+00:00, sha c4734942d527)
- Data as of 2026-08-30T08:39:29.467469+00:00.