lolbins 开源项目推荐（53 个）

LOLBAS-Project /LOLBAS

Living Off The Land 二进制文件和脚本 -（LOLBins 和 LOLScripts）

api0cradle /LOLBAS

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

gnh1201 /welsonjs

WelsonJS - Built-in JavaScript for Industrial Automation on Windows

strontic /xcyclopedia

Encyclopedia for Executables

Kudaes /LOLBITS

** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.

lolexfil /lolexfil.github.io

Living off the land Data Exfiltration methods

0xAnalyst /Project-Lost

Living Off Security Tools

danzek /awesome-lol

Living off the Land (LOL) attack techniques, tools, and defender resources

NDevTK /UACSpoof

Spoofing the Windows UAC "verified" publisher :)

WesleyWong420 /Build-Your-Own-LOLBins

A post-exploitation toolkit to simulate the weaponization and detection of native Windows binaries based on LOLBas framework.

Pwn3rx0 /Obfuscated-PS-Reverse-Shell

Obfuscated PowerShell reverse shells for security research and testing purposes.

steveandreassend /linux_auditd

Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules. If you need help with implementation, [email protected]

Ilias1988 /LOLBins-Reference

A unified, interactive reference for Living Off The Land Binaries (LOLBAS & GTFOBins). Features a dynamic payload builder (LHOST/LPORT), real-time search, MITRE ATT&CK mapping, and auto-updates from official sources.

joshuaruppe /winprivesc

Windows batch script for system enumeration and spotting privilege-escalation routes. Stock cmd.exe only: no PowerShell, no wmic, no external tools.

Excalibra /GhostLNK

GhostLNK is a professional-grade Windows LNK (shortcut) file generator with advanced stealth capabilities. It converts remote URLs (Dropbox, VPS, etc.) into PowerShell commands, encodes them in Base64, and embeds them into legitimate-looking LNK files that bypass modern AV detection.

MatiasZapf /win-mediakey-lolbin

Ultra-lightweight (~4KB) CLI tool to control Windows media playback. Built natively using csc.exe (Living Off the Land / LOLBin) without external dependencies.

hdks-bug /LOLGEN

LOLGEN: Living Off The Land Payload Generator

darmado /attack-macOS

A library of post-exploitation MacOS scripts based on threat emulation, LOObins, CTI, and MITRE ATT&CK.

ejaz629 /peeler

Ransomware dataset, containing dynamic behaviour of more than 60 distinct ransomware families.

jacobstickney /ThreatActorProcedures-MITRE-ATTACK

A collection of specific commands used by threat actors, detailing their procedural implementations of tactics and techniques from the MITRE ATT&CK framework.