LOLBAS: Living Off the Land Binaries, Scripts and Libraries

”Download” does not mean what you think it does here, it’s a tag that means the file mentioned, which I’m not sure is available here at all, has download capacities. Click the logo for more info. But sure, that could be the url here.

It’s dual use, like Metasploit. It’s hard to predict whether black hats or white hats will use it more often or not. I think your conclusion is more intuitive, but let me play devil’s advocate.

LotL is too advanced for script kiddies to pull off. You’re already dealing with an adversary with some sophistication, who likely have the time, skill, and resources to create their own LOLbins (or buy them on darknet forums). Infosec is an asymmetric conflict: the adversary has a much easier job IMO. It’s always easier to break something than to build it.

Blue/purple teams have little incentive to build their own LOLbins. There is another asymmetry here: blue teams are developing these to target only their networks. Red teams are developing them to target every network. Open source is the way to resolve that asymmetry.

With these becoming public, blue teams can simulate a LotL attack, develop indicators of attack, and write rules to trigger alerts.

In general, adversaries prefer their tricks to remain trade secrets. Once they’re known, documented, and commodified, they become far less useful.

Is it possible for people to stop polluting perfectly valid namespaces? I understand that the metaphors and analogies make snese but every time this occurs, whether it's software, films, or whatever, it furthers destroys the integrity of already crumbling search engines.

Edit: Because apparently this isn't clear enough:

1. Real world phenomena and technical projects are two distinctive categories, each encompassing a wealth of unique information.

2. Namespaces serve as unique identifiers, used to prevent naming conflicts in various domains.

3. When these namespaces are used within both real-world phenomena and technical projects, they overlap.

4. Overlapping namespaces, by their nature, blur the boundaries between distinctive categories.

5. Search engines operate by categorizing and associating information based on identifiers, specifically namespaces.

6. When these identifiers are blurred, the precision of search engines is compromised.

7. As search engine precision diminishes, the efficacy of search results for users decreases.

8. The reduction in search results efficacy translates to increased search times and decreased productivity, or an inability to find anything about the topic whatsoever due to results pruning.

9. A decrease in productivity is an indirect impact of namespace pollution, disrupting both those living in the real-world and those looking for technical information.

10. We already have to deal with SEO. We shouldn't need to deal with this as well.

I didn’t know these compiled lists like this existed and I’m like old…

I’ve been manually going to find this kind of documentation since forever. This is great and so helpful

Command and Control: https://en.wikipedia.org/wiki/Botnet#Command_and_control