A single, searchable directory of the community's Living-Off-the-Land security research — every LOLBin, LOLDriver, and adjacent project, indexed and cross-referenced by platform and focus area.
Living off the False Positive — an autogenerated collection of false positives sourced from popular rule sets, categorized by ATT&CK techniques, rule source, and data source.
Living Off The Land Drivers — a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks.
A curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques.
Attackers use popular legitimate domains for phishing, C&C, exfiltration and tool downloads to evade detection. This list catalogs domains that allow user-controlled subdomains.
File extensions being used by attackers — a reference for defenders tracking evolving delivery techniques.
An interactive cheat sheet of offensive security tools and commands for Windows/AD environments.
Living Off the Orchard: macOS Binaries — detailed information on built-in macOS binaries and how threat actors abuse them.
Exploitation isn't limited to command-line binaries — built-in and third-party applications get abused too. This project catalogs those techniques.
A curated list of known malicious bootloaders across operating systems, helping defenders stay informed on bootloader-based threats.
BYOL — a red-teaming technique where operators carry their own tools instead of relying on what's present on the target.
A resource collection for identifying and utilizing malicious hardware and devices.
A WTFBin is a binary that behaves exactly like malware — except, somehow, it's not.
Living Off the Foreign Land — Cmdlets and Binaries (LOFLCABs) that perform activities from the local Windows system against a remote system.
Information on Windows persistence mechanisms, organized to make protection and detection more efficient.
Details of code-signing certificates known to be abused in the wild — stolen or legally-acquired, then used to sign malware.
Catalogs CI/CD tools with lesser-known RCE-by-design features ("foot guns") that enable arbitrary code execution through untrusted changes or workflow injection.
Helps cyber defenders understand how LOLBin binaries are used by threat actors during an intrusion, in a graphical and digestible format.
A comprehensive list of binaries and scripts natively available in VMware ESXi that adversaries have used in their operations.
A curated list of Remote Monitoring and Management (RMM) tools that could potentially be abused by threat actors.
A community-driven project documenting webhooks that may be exploited for data exfiltration and C2 communications.
A curated list of security tools used by adversaries to bypass security controls and carry out attacks.
Documents digital tunnels that can be abused by threat actors or insiders for data exfiltration, persistence, and shell access.
A comprehensive collection of Active Directory techniques, commands, and functions usable natively for offensive security operations and red team exercises.
A collection of C2 frameworks that leverage legitimate services to evade detection.
Real-world abused APIs across Windows, cloud, and browser platforms — with detection strategies, mitigation guidance, and red-team POCs.
A comprehensive catalog of data exfiltration methods with detection patterns, simulation examples, IOC artifacts, and ATT&CK mappings.
Living Off Free SaaS — a directory of free SaaS platforms used for C2, exfiltration, and adversary tooling, with ATT&CK mappings and detection logic.
Living Off Trusted Email — a quick-reference for leveraging trusted platforms' email features to deliver phishing during social engineering campaigns.
Inspects AI agent skill bundles — instructions, scripts, and config — for hidden or harmful behavior before you install them, using Nova and YARA detections with correlated evidence.
A curated list of Unix binaries whose arguments can be exploited for argument injection — enabling shell escapes, privilege escalation, and arbitrary file read/write.
Process execution hidden behind wildcard and glob pattern evasion, catalogued across shells and platforms and mapped to ATT&CK tactics.
A reference catalog of default and embedded credentials across products and platforms — where they live, what they look like, and what they unlock.
OAuth and OIDC applications observed being abused in real attacks, with consent artifacts, indicators, and detection guidance for identity teams.
Documents command-line obfuscation across Windows, Linux, and macOS — which utilities tolerate which mangling, and generates working obfuscated equivalents to test defenses.
Want to see how you can protect your assets from these attacks? Try free for up to 100 endpoints with this affiliate link.
start free trial →