srl
Living off the Land
LOLBins and LOLBAS are signed, Microsoft-shipped binaries already present on a default Windows install. They exist so nothing unsigned touches disk — the ideal primitive when application control blocks your tooling. But the binaries are trusted while the behaviour is not: EDR heavily monitors certutil, bitsadmin, mshta, regsvr32, and PowerShell reaching out to the internet. Prefer an internal staging host, a non-standard filename, and cleanup.
0. What Changed in 2025–2026 Two platform changes alter which LOLBins you can rely on: