Views: 5
🌿 Living Off the Land (LOTL) Resources 🗺️
🎯 Attackers don’t always bring their own tools. Sometimes the best weapon is already sitting on the machine. This guide walks through a well-organized collection of Living Off the Land (LOTL) catalogs, grouped by category, so defenders, red teamers, and researchers know where to look.
🤔 What Is “Living Off the Land”?
LOTL means abusing legitimate, trusted tools and processes that already exist in an environment, instead of dropping custom malware. Because the activity comes from software that is supposed to be there, it blends into normal operations and is much harder to spot.
The resources below catalog these techniques so you can understand them, hunt for them, and defend against them. 🛡️
🖥️ 1. Operating System Binaries and Scripts
Built-in OS tools that can be bent to do things they were never meant to do.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| GTFOArgs | Unix binaries that can be exploited through argument injection | gtfoargs.github.io |
| GTFOBins | Unix binaries that help bypass local security restrictions | gtfobins.github.io |
| LOLBAS | Windows binaries, scripts, and libraries | lolbas-project.github.io |
| LOOBins | “Living Off the Orchard” – abusable macOS binaries | loobins.io |
| LOLESXi | Binaries and scripts in VMware ESXi that adversaries use | lolesxi-project.github.io |
| WTFBins | Suspicious Windows binaries and how they behave | wtfbins.wtf |
⚙️ 2. Drivers and Low-Level Components
Going deeper than the OS layer, down to boot and kernel territory.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| Bootloaders | Known malicious bootloaders across operating systems | bootloaders.io |
| LOLDrivers | Vulnerable and malicious Windows drivers | loldrivers.io |
📦 3. Applications and Tools
Software that’s installed on purpose, and sometimes abused anyway.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| LOLAPPS | Built-in and third-party apps misused for malicious ends | lolapps-project.github.io |
| LOLRMM | Remote Monitoring and Management tools that attackers can repurpose | lolrmm.io |
🔌 4. Hardware and Firmware
The physical side of LOTL.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| LOTH | Identifying and using malicious hardware and devices | lothardware.com.tr |
🥷 5. Evasion and Exploitation Techniques
How attackers slip past defenses and turn trusted components against their owners.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| Argument Injection Vectors | Exploitable options behind argument injection bugs | sonarsource.github.io |
| Evasions | Understanding and applying a wide range of evasion techniques | evasions.checkpoint.com |
| HijackLibs | DLL hijacking techniques and the libraries that are vulnerable | hijacklibs.net |
| LOFL | Cmdlets and binaries for remote activity and unusual persistence | lofl-project.github.io |
| LOTD | Dev tools in CI/CD pipelines that offer remote code execution | boostsecurityio.github.io/lotp |
| LOTS Project | “Living Off Trusted Sites” – legitimate domains attackers can abuse | lots-project.com |
| LOTTunnels | Digital tunnels used for exfiltration, persistence, and more | lottunnels.github.io |
| LOTWebhooks | Webhooks exploited for data theft and C2 traffic | lotwebhooks.github.io |
| Sploitify | Database of exploits and vulnerabilities for systems and apps | sploitify.haxx.it |
🔁 6. Persistence Mechanisms
Staying put after the initial foothold.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| Persistence Info | Windows persistence techniques, with detection and mitigation in mind | persistence-info.github.io |
🔐 7. Certificates and Trust
When a valid signature becomes a disguise.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| LOLCerts | Code signing certificates abused by threat actors | github.com/WithSecureLabs/lolcerts |
📡 8. Command and Control
Hiding C2 traffic inside legitimate services.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| LOLC2 | C2 frameworks that ride on legitimate services to avoid detection | lolc2.github.io |
🏢 9. Active Directory and Windows-Specific
Everything for the heart of the enterprise.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| LOLAD | A broad set of Active Directory techniques for offensive operations | lolad-project.github.io |
| WADComs | One-liners and commands for Windows AD environments | wadcoms.github.io |
🧬 10. APIs and Malware Analysis
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| MalAPI | Windows API reference for malware analysis and red teaming | malapi.io |
🎲 11. Miscellaneous
A few extras that don’t fit neatly elsewhere.
| 🔧 Project | 📝 What It Covers | 🌐 Link |
|---|---|---|
| FileSec | File extensions and the security risks tied to each | filesec.io |
| LOLBins CTI Driven | Graphical view of how threat actors use LOLBins | lolbins-ctidriven.vercel.app |
| Project Lost | Lesser-known techniques and tools for red teaming and pentesting | 0xanalyst.github.io/Project-Lost |
🚀 Final Thoughts
LOTL attacks work because they exploit trust: trusted binaries, trusted drivers, trusted domains, trusted certificates. Knowing what’s abusable in your environment is the first step toward detecting it.
💡 Bookmark this list, and use it to sharpen your threat hunting, detection logic, and hardening priorities.
#LOTL #LivingOffTheLand #CyberSecurity #ThreatHunting #BlueTeam #RedTeam
