LOLBAS is a knowledge base that documents Microsoft-signed binaries, scripts, and libraries that can be repurposed for living-off-the-land techniques.
The project addresses the need to catalog and understand how legitimate system files can be abused beyond their intended purpose. It maintains a curated collection of entries documenting unexpected functionality in Microsoft-signed executables and libraries, focusing on capabilities useful to attackers or red teams such as code execution, file operations, credential theft, UAC bypass, and log evasion. Each entry is stored as a YAML file and presented through a web frontend that makes the information searchable and accessible.
Security teams and penetration testers should adopt this tool to understand the attack surface presented by built-in Windows binaries and to improve detection and defense strategies. The project is particularly valuable for blue teams conducting threat hunting and incident response, as well as for red teams and purple teams conducting authorized security assessments. It serves as a reference for application whitelisting bypass techniques and helps defenders recognize when legitimate system tools are being misused. The project maintains strict criteria for inclusion, requiring that documented binaries be Microsoft-signed and possess functionality beyond their intended use, which keeps the collection focused on genuinely exploitable capabilities rather than documented features.
The project maintains active quality control through automated YAML linting on contributions. The repository accepts community submissions following a defined template and contribution guidelines, indicating ongoing curation and expansion of the knowledge base. Development activity centers on validating and integrating new LOLBin, LOLScript, and LOLLib discoveries from the security community.
