LOLBAS

Addinutil.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

AppInstaller.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Aspnet_Compiler.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

At.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Atbroker.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Bash.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Bitsadmin.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Certoc.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Certreq.yml

Moved text to correct line (#349 )

2024-02-17 17:14:08 +00:00

Certutil.yml

Applying MITRE ATT&CK v15 changes (#370 )

2024-04-24 15:10:59 +01:00

Cmd.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Cmdkey.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Cmdl32.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Cmstp.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Colorcpl.yml

Added colorcpl.exe (#315 )

2023-07-27 18:18:49 +01:00

ComputerDefaults.yml

Add ComputerDefaults.yml (#400 )

2024-09-25 23:47:41 +01:00

ConfigSecurityPolicy.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Conhost.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Control.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Csc.yml

Fixing some paths / adding some paths, this will improve upstream hunting tool efficacy if proper paths are referenced in the yml (#392 )

2024-09-07 15:07:46 +01:00

Cscript.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

CustomShellHost.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

DataSvcUtil.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Desktopimgdownldr.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

DeviceCredentialDeployment.yml

…

Dfsvc.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Diantz.yml

Add Diantz directives/DDF entry to diantz.exe (#390 )

2024-08-17 22:02:55 +01:00

Diskshadow.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Dnscmd.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Esentutl.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Eventvwr.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Expand.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Explorer.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Extexport.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Extrac32.yml

Adding more operating systems to extrac32.exe (#387 )

2024-08-17 22:10:48 +01:00

Findstr.yml

Update MITRE T1185 to T1105 (#345 )

2024-02-17 17:30:52 +00:00

Finger.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

FltMC.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Forfiles.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Fsutil.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ftp.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Gpscript.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Hh.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ie4uinit.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Iediagcmd.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ieexec.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ilasm.yml

…

IMEWDBLD.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Infdefaultinstall.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Installutil.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Jsc.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ldifde.yml

Add sigma and remove ampty string (#297 )

2023-06-17 20:30:00 +01:00

Makecab.yml

Makecab - LOLBAS command, more information about Windows compatibility (#389 )

2024-08-17 22:16:07 +01:00

Mavinject.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Microsoft.Workflow.Compiler.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Mmc.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

MpCmdRun.yml

…

Msbuild.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Msconfig.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Msdt.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

msedge_proxy.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Msedge.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

msedgewebview2.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Mshta.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Msiexec.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Netsh.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Ngen.yml

Fixing some paths / adding some paths, this will improve upstream hunting tool efficacy if proper paths are referenced in the yml (#392 )

2024-09-07 15:07:46 +01:00

Odbcconf.yml

Odbcconf.yml - Corrected incorrect privileges (#396 )

2024-09-07 15:01:46 +01:00

OfflineScannerShell.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

OneDriveStandaloneUpdater.yml

Adding Windows file path validation for values of File_Path (#403 )

2024-10-01 23:14:19 +01:00

Pcalua.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Pcwrun.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Pktmon.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Pnputil.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Presentationhost.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Print.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

PrintBrm.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

printui.yml

printui.exe lolbas Requestt

2025-01-12 02:45:15 +03:00

Provlaunch.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Psr.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Rasautou.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Rdrleakdiag.yml

Update SigmaHQ ref (#301 )

2023-06-19 22:40:24 +01:00

Reg.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Regasm.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Regedit.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Regini.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Register-cimprovider.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Regsvcs.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Regsvr32.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Replace.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Rpcping.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Rundll32.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Runexehelper.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Runonce.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Runscripthelper.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Sc.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Schtasks.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Scriptrunner.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Setres.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

SettingSyncHost.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Ssh.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Stordiag.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Syncappvpublishingserver.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Tar.yml

Add Detection Sigma ref (#368 )

2024-04-19 18:53:37 +01:00

Ttdinject.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Tttracer.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Unregmp2.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Vbc.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Verclsid.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wab.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wbadmin.yml

Create wbadmin (#364 )

2024-04-05 19:38:21 +01:00

Winget.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wlrmdr.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wmic.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

WorkFolders.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wscript.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Wsreset.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

wt.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Wuauclt.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

Xwizard.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00