LOLBins

LOLBins, short for living-off-the-land binaries, are legitimate system binaries and scripts that are already present on a host. In security contexts, they refer to the practice of using these trusted tools to perform actions such as code execution, file manipulation, lateral movement, and data exfiltration without introducing new, potentially detectable software. The concept highlights how attackers can leverage existing, whitelisted software to operate within an environment.

Because LOLBins are trusted by the operating system and often by security controls, their abuse can help adversaries evade certain defenses and blend into normal activity. The term emphasizes the tension between using ordinary system components and the security risks that arise when those components are repurposed for unauthorized or malicious tasks. It is closely associated with the broader idea of living off the land, where attackers minimize the need for external tools.

LOLBins cover a range of categories, including command-line interpreters, scripting hosts, common system utilities, networking and data-transfer tools, and components from office and browser ecosystems. They do not inherently indicate malicious intent; rather, their misuse depends on context, timing, and how they are invoked within a target environment.

Defense against LOLBins centers on visibility, control, and discipline. Key strategies include monitoring for unusual or unexpected usage of trusted binaries, enforcing least-privilege access, implementing application allowlists, and collecting comprehensive telemetry on process creation and command-line activity. Regular auditing, robust endpoint protection, and threat-hunting techniques further help detect and disrupt LOLBin abuse.

See also: living off the land techniques, MITRE ATT&CK framework, endpoint security, threat hunting.