LOLBins: Living Off The Land
- LOLBins = legitimate, signed, pre-installed Windows binaries abused to do malicious work. No malware to detect — just trusted tools misused.
- Common examples:
rundll32.exe— run exported DLL functions (incl. remote/JS).regsvr32.exe— register a DLL; "Squiblydoo" runs remote scriptlets.mshta.exe— execute HTA / inline VBScript / JScript.certutil.exe— download files, base64 decode payloads.- Others:
msbuild,installutil,bitsadmin,wmic. - Reference project: LOLBAS (Living Off The Land Binaries And Scripts) catalogs these.
Key Takeaway
When a signed system tool reaches out to the internet or spawns a shell, the anomaly is the behavior, not the binary.