LOLBAS-Project/LOLBAS resource

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

8771 stars · 1172 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A curated dataset of YML files documenting Windows binaries, scripts, and libraries that can be abused for 'Living Off The Land' techniques like code execution, downloads, persistence, and UAC bypass. It powers a searchable frontend at lolbas-project.github.io with MITRE ATT&CK mappings.

Use cases

• find windows binaries that can download files for red team tradecraft
• look up which LOLBins map to a MITRE ATT&CK technique
• hunt for abuse of signed microsoft binaries in DFIR investigations
• document application whitelisting bypass techniques
• find LOLBins for UAC bypass or credential theft
• compare windows LOLBins against unix GTFOBins equivalents

When to choose

• you need a reference of Microsoft-signed binaries with unexpected offensive functionality
• you are doing red team, purple team, or detection engineering on Windows
• you want ATT&CK-mapped documentation of LOLBin techniques

When to avoid

• you need UNIX/Linux equivalents - use GTFOBins instead
• you are looking for malicious Windows drivers - use loldrivers.io
• you need an offensive tool that executes techniques rather than documents them

Facets

dataset · maturity active

security penetration-testing vulnerability-scanning documentation security penetration-testing windows developer-tools windows cli lolbins red-team blue-team dfir threat-hunting mitre-attack yml-database gtfobins web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="LOLBAS-Project/LOLBAS")