admin/LOLBAS-Project-LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2026-06-21 13:43:46 +00:00
Code Issues Packages Projects Releases Wiki Activity
846 Commits 4 Branches 0 Tags
master
Commit Graph

846 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
bogackaya f06df108ee Update Msoxmled.yml (#512) 
Fix handle for Furkan Celik in Msoxmled.yml
 2026-06-16 19:35:36 +01:00
Wietze 406ccc34a5 Create setupugc.yml for OS binaries configuration 2026-06-15 23:40:28 +01:00
karminang 6985f2ad3e Adding setupupc.exe (#498) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-06-15 23:39:31 +01:00
bogackaya af48960e10 Add msoxmled.exe for INetCache downloads (#458) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-06-15 23:02:48 +01:00
Wietze 1c2234bd3a Change Outlook command to use {REMOTEURL} placeholder 
Updated Outlook command to use a placeholder for remote URL.
 2026-06-15 22:53:11 +01:00
C-h4ck-0 8b476a5e4f Updates to scp.exe, sftp.exe and new outlook.exe entry (#265) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-06-15 22:03:43 +01:00
Wietze c8939ac93d Fix command description in Scp.yml 
Updated command description to reflect the correct executable.
 2026-06-15 21:04:30 +01:00
x90slide 24a46a7e52 Add SCP.exe for execute operation (#509) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-06-15 20:50:20 +01:00
unrooted 5814631f55 Windows Sandbox abuse via wsb.exe (#504) 
---------

Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-06-14 21:27:23 +01:00
4n4s4zi fe428063d6 Adding mscopilot.exe and mscopilot_proxy.exe (#497) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-05-09 12:16:00 +01:00
Wietze db6da5b030 Adding VirusTotal link to DevToolsLauncher.yml, closes #155 2026-03-16 14:12:08 +00:00
Avihay Eldad 2a21e4a4b4 Create Logger.yml (#448) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 14:00:01 +00:00
Avihay Eldad 6a6364085b Create Nmcap.yml (#462) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 13:51:21 +00:00
ghosts621 41458bdce0 Add App Paths Hijacking (Proxy Execution) to WorkFolders.exe (#490) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 13:43:24 +00:00
ghosts621 fb87ee5f08 Add new Proxy Execution techniques for dxcap.exe and cmstp.exe (#489) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 13:33:27 +00:00
Majkel Skopniarz c39a24f3ce Create write.yml (#440) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 13:19:47 +00:00
Alexander Sennhauser cea80b95ee Adding cipher.exe entry (#274) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-16 12:30:32 +00:00
Ekitji 42a5add3c7 UAC bypass via odbcad32.exe GUI (#460) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-14 11:59:51 +00:00
Tonmoy Jitu 0c3b8d7786 Added Sigverif.yml (#469) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2026-03-14 11:48:31 +00:00
Avihay Eldad b463e865f3 Create IntelliTrace.yml (#464) 2025-12-06 22:05:02 +00:00
Liran Ravich 005c784dab Wsl and bash (#468) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-12-06 22:02:52 +00:00
MahirAli Khan f793a4d5c9 Create Bcp.yml (#476) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-12-06 21:34:11 +00:00
Wietze dcca4db04a Improve GitHub Actions workflows (#467) 2025-10-02 18:14:34 +01:00
Wietze 2d7441bb9a Fixing typo in Mpiexec.yml 2025-09-29 22:09:42 +01:00
vict0ni db83c335cb Update Regsvr32.yml (#461) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-29 21:55:00 +01:00
Avihay Eldad 9d6d66a3cd Create Mpiexec.yml (#466) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-29 21:51:25 +01:00
Avihay Eldad 58a6ef8d1e Create AppLauncher.yml (#465) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-29 21:50:52 +01:00
Avihay Eldad 7b44bd9ac6 Create Pixtool.yml (#463) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-29 21:47:41 +01:00
idabian 6d07c2dee1 Add RDS Binaries (#453) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-10 19:08:49 +01:00
Black Shade cb3ee9b4a5 ADD reset.exe (#454) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-09-10 18:40:42 +01:00
Ekitji b2550124fe iscsicpl.exe UAC bypass (#455) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-08-31 17:09:32 +01:00
Avihay Eldad b04a5c9776 Create XBootMgr.yml (#447) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-08-31 16:38:57 +01:00
Avihay Eldad ed6d8aa11d Create Ntsd.yml (#449) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-08-31 16:33:36 +01:00
Avihay Eldad e0f262f32b Create WinDbg.yml (#450) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-08-31 16:22:52 +01:00
frack113 5927125030 docs: 📚 Add Detection Sigma ref (#451) 2025-07-22 21:27:15 +01:00
Avihay Eldad a4199124bc Update XBootMgrSleep.yml (#445) 
* Add xbootmgrsleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

---------

Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-07-10 10:47:39 +01:00
Avihay Eldad 4ea5c504a4 Add PhotoViewer.yml (#441) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-06-28 15:04:30 +01:00
TimOne 803118bda7 Add resources link (#442) 
Add the LOLBAS series to help Blue Team personnel learn how to detect this technology through their browsers.
 2025-06-26 22:56:39 -04:00
itssixtyn3in 967d88a0fa Update Sqldumper.yml (#439) 2025-06-11 19:30:51 +01:00
Wietze 9016c65b87 Create CODEOWNERS (#438) 2025-06-01 13:21:27 +01:00
Fred Cyber Security ea4d2a87b0 Update Winget.yml (#436) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-06-01 13:15:55 +01:00
Fred Cyber Security d6e3d7016d Update Mmc.yml (#437) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-06-01 13:04:47 +01:00
Avihay Eldad e31a869ae4 Add ECMangen.yml (#373) 2025-05-28 14:22:56 +01:00
Avihay Eldad dcad562e5f Add XBootMgrSleep.yml (#381) 
* Add xbootmgrsleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

* Update XBootMgrSleep.yml

---------

Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-05-28 14:15:30 +01:00
LocalLoopBack d5ce81d2c8 Update Certutil.yml with new flag and update previous flag (#402) 2025-05-26 21:16:10 +01:00
Swachchhanda Shrawan Poudel 387546895e feat: Indirect Command Execution via sftp.exe (#434) 
* feat: Indirect Command Execution via sftp.exe

* Minor changes

* Improved description

* Update Sftp.yml

---------

Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-05-26 18:03:15 +01:00
socketz 373d0a52bb Update Shell32.yml (#435) 
* Update Shell32.yml

Added Control_RunDLLNoFallback used by threat actors.

* Update Shell32.yml

---------

Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-05-26 17:43:59 +01:00
iamtutu f8b06c611f Added Cipher (#410) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-04-26 20:42:34 +01:00
saulpanders 18b1648e97 Added wbemtest.exe (#430) 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
 2025-04-26 20:27:13 +01:00
Wietze e15a9c3e27 Updates for ATT&CK v17 2025-04-26 20:23:10 +01:00