İremDamar·Dec 23, 2025LOLBAS Alert’leri: Ne Zaman Müdahale Gerekir?Bir SOC analisti olarak PowerShell, rundll32 ya da certutil içeren bir alert gördüğümüzde refleksimiz çoğu zaman aynıdır: “Bu kesin…
R3dLevy·Nov 4, 2025Evading Windows Security: A List of AppLocker Bypass Techniques with LOLBAS🔐 Introduction
Yaniv·Sep 18, 2025Lolbasline: Baseline Windows Systems For Living Off The Land BinariesTL;DR: Lolbasline is a powershell module that parses lolbas yaml definitions, checks for binary presence on windows, and attempts…
Yaniv·Aug 30, 2025Mapping malicious file extensions: practical observations and controlsTL;DR: The list catalogs file extensions attackers commonly use for executable delivery, scripting, and archive-based payloads; use it as a…
Need·Dec 11, 2024Pester-ing LOLBASWhile messing around with Pester.bat from the LOLBAS project, it’s mentioned that it can be executed from
Domiziana Foti·Sep 2, 2024LetsDefend-SOC-164- Suspicious Mshta BehaviorWe have a new alert regarding low reputation hta file executed via mshta.exe.
Tuba Kavgacı·Jan 27, 2024LOLBASMerhaba, bu yazımda LOLBAS konusundan bahsedeceğim.A response icon1A response icon1
mthcht·Aug 23, 2023LOLBAS Detection Serie [2] — Mspub.exe + ProtocolHandler.exe + MsoHtmEd.exeThe LOLBAS serie : https://medium.com/@mthcht/list/lolbas-843ba9de6810
![LOLBAS Detection Serie [2] — Mspub.exe + ProtocolHandler.exe + MsoHtmEd.exe](https://miro.medium.com/v2/resize:fill:160:106/1*sdEAf0ONbHLg56GtfWN8QQ.png)
![LOLBAS Detection Serie [2] — Mspub.exe + ProtocolHandler.exe + MsoHtmEd.exe](https://miro.medium.com/v2/resize:fill:320:214/1*sdEAf0ONbHLg56GtfWN8QQ.png)