Simple definition
LOLBins are legitimate executables whose capabilities can be abused during an attack.
Purpose and use
An attacker seeks to use tools already present or approved to perform actions that may appear less conspicuous because the software is legitimate.
How does it work?
Risk depends on the invoked function, parameters, account and surrounding processes. The same program may support normal maintenance or an incident.
Key points
- Example: a system binary is launched from a directory or parent process unrelated to its expected use.
- Preserve process ancestry and related events to compare the behavior with normal operations.
Points to watch
A list of executable names is not a sufficient detection rule. Controls must account for legitimate administration requirements.
In short
LOLBins are legitimate executables open to abuse; LotL is the broader approach of misusing existing capabilities.