LOLBASProject maintainers
The people who keep LOLBAS moving. Find them on X.
The goal
Document every Microsoft-signed binary, script, and library that can be used for living off the land techniques. Legitimate tools can execute code, transfer files, bypass application allowlisting, access credentials, and perform other actions beyond their expected use.
What belongs in LOLBAS?
- A Microsoft-signed file, native to Windows or available from Microsoft.
- Unexpected functionality, with an exception for application allowlisting bypasses.
- Functionality useful in adversary simulation or to an advanced threat actor.
Read the full criteria before submitting a finding.
Built by the community
The phrase “living off the land” was coined by Christopher Campbell and Matt Graeber at DerbyCon 3. LOLBAS grew from community research into a shared catalog maintained by volunteers.
The original project logos were created by Adam Nadrowski.
Add your finding
Start with the contribution guide and YAML template. The original source format remains unchanged.
Explore the repository ↗Keep exploring
For Unix binaries, visit GTFOBins. For Windows drivers, visit LOLDrivers.