LOLBAS. GitHub

FOLLOW THE RESEARCH

The bigger picture.

How the catalog grows. What the tools can do. Where detection resources exist.
A view of the community’s research, grounded in the source data.

THE KNOWLEDGE KEEPS GROWING

A growing body of research.

↗
245documented entries
since 2018 Cumulative entries
2018: 95 total, 95 added20182019: 110 total, 15 added20192020: 133 total, 23 added20202021: 162 total, 29 added20212022: 187 total, 25 added20222023: 200 total, 13 added20232024: 214 total, 14 added20242025: 235 total, 21 added20252026: 245 total, 10 added2026

Based on entry creation dates. Catalog growth, not threat activity.

View chart data
YearAddedTotal
20189595
201915110
202023133
202129162
202225187
202313200
202414214
202521235
202610245

WHAT’S IN THE CATALOG

By file type.

OS Binaries136OS Libraries17OS Scripts10Other Microsoft Binaries82

245 entries from the four published YAML collections. Honorable mentions remain outside the published catalog.

UNEXPECTED CAPABILITIES

Functions across the catalog.

Execute159Download57AWL Bypass35ADS26Dump12Copy11UAC Bypass7Upload5Compile4Credentials4Tamper4Reconnaissance3Conceal1Decode1Encode1

Count of entries with at least one command in each category. An entry can have multiple functions, so these counts overlap.

TURN RESEARCH INTO DEFENSE

Detection resources.

203 / 245

Entries with at least one published detection link, such as Sigma, Elastic, Splunk, analysis, or block rules. IOC-only entries are excluded. Links are research leads; coverage does not guarantee that a technique will be detected.

Explore detection resources ↗

59 ATT&CK technique IDs.

Distinct technique and sub-technique IDs mapped to command examples.

Download Navigator layer ↓