Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Encyclopedia for Executables

WelsonJS - Build a Windows app on the Windows built-in JavaScript engine

** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.

Living Off Security Tools

Living off the land Data Exfiltration methods

Living off the Land (LOL) attack techniques, tools, and defender resources

A post-exploitation toolkit to simulate the weaponization and detection of native Windows binaries based on LOLBas framework.

Obfuscated PowerShell reverse shells for security research and testing purposes.

Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules.

Spoofing the Windows UAC "verified" publisher :)

Ultra-lightweight (~4KB) CLI tool to control Windows media playback. Built natively using csc.exe (Living Off the Land / LOLBin) without external dependencies.

LOLGEN: Living Off The Land Payload Generator

Ransomware dataset, containing dynamic behaviour of more than 60 distinct ransomware families.

A library of post-exploitation MacOS scripts based on threat emulation, LOObins, CTI, and MITRE ATT&CK.

A collection of specific commands used by threat actors, detailing their procedural implementations of tactics and techniques from the MITRE ATT&CK framework.

A C2 server designed to run within Electron applications.

GhostLNK is a professional-grade Windows LNK (shortcut) file generator with advanced stealth capabilities. It converts remote URLs (Dropbox, VPS, etc.) into PowerShell commands, encodes them in Base64, and embeds them into legitimate-looking LNK files that bypass modern AV detection.

Script is written to fetch LOLBin Details from Security and Sysmon EVTX file.