Trusted Surfaces

Living off the Land

Execution, abuse paths, and operator tradecraft hiding in trusted binaries.

LOLBIN studies, edge-case behaviors, and practical notes on abusable Windows binaries.

Notes14

Latest Update2026-04-17

Route/research/categories/living-off-the-land

lolbincommand-executiondetection-engineeringdfir

Category Index

All research filed under this constellation.

Latest notes appear first so the category stays useful as a focused, living archive rather than a dead taxonomy page.

Living off the Land

2026-04-17

lolbins

Living of the Land - Windows Terminal - Delegation Abuse

Source code analysis of the Windows Terminal delegation chain and how the per-user DelegationConsole and DelegationTerminal values can be abused to start a custom console through the normal default terminal handoff flow.

ConstellationLiving off the Land · lolbins

windowsterminalconsole

Read note

Living off the Land

2026-04-06

lolbins

Living of the Land - SensorLogonTask.exe

Exploring the SensorLogonTask.exe utility, its functionality, and how it can be used a some sort of Living off the Land Binary (LOLBin), if you can call it that.

ConstellationLiving off the Land · lolbins

lolbinwindows

Read note

Living off the Land

2026-02-02

lolbins

Living of the Land - Curl - Percent Encoded URLs

Exploring the curl utility's ability to accept percent encoded URLs and its implications for security and detection.

ConstellationLiving off the Land · lolbins

lolbinwindowsdetection-engineering

Read note

Living off the Land

2024-07-08

lolbins

Living of the Land - AgentExecutor

Detailed analysis of the AgentExecutor binary, its execution paths, and how it can be leveraged for code execution. Based on version 1.80.133.0 and Microsoft.Management.Clients.IntuneManagementExtension.WinGetLibrary.dll version 1.79.160.0.

ConstellationLiving off the Land · lolbins

lolbinwindowswinget

Read note

Living off the Land

2024-01-13

lolbins

Living of the Land - Datacollector.EXE

Deep dive into the Datacollector.exe utility, its functionality, and how it can be used as a Living off the Land Binary (LOLBin) for proxy execution.

ConstellationLiving off the Land · lolbins

lolbinwindowsvisual-studio

Read note

Living off the Land

2023-12-25

lolbins

Living of the Land - Arbitrary Command Execution Via Windows Kit's StandaloneRunner

Exploring the StandaloneRunner.exe utility included with the Windows Driver Kit (WDK), its functionality, and how it can be used to achieve arbitrary command execution.

ConstellationLiving off the Land · lolbins

lolbinwindowscommand-execution

Read note

Living off the Land

2023-05-31

lolbins

Living of the Land - Odbcconf.exe

Exploring the Odbcconf.exe utility, its functionality, and how it can be used as a Living off the Land Binary (LOLBin) for persistence and execution.

ConstellationLiving off the Land · lolbins

lolbinwindowspersistence

Read note

Living off the Land

2023-05-31

lolbins

Living of the Land - TisEzIns (Trend Micro)

Exploring the TisEzIns utility included with Trend Micro, its functionality, and how it can be used to download arbitrary files.

ConstellationLiving off the Land · lolbins

lolbinwindowscommand-execution

Read note

Living off the Land

2023-04-21

lolbins

Living of the Land - WinExec - Symantec Endpoint Protection Manager (SEPM)

Exploring the WinExec.EXE utility included with Symantec Endpoint Protection Manager (SEPM), its functionality, and how it can be used to achieve arbitrary command execution.

ConstellationLiving off the Land · lolbins

lolbinwindowscommand-execution

Read note

Living off the Land

2023-04-18

lolbins

Living of the Land - NetLimiter - PSRun.exe

Deep dive into the PSRun.exe utility from NetLimiter, its functionality, and how it can be used as a Living off the Land Binary (LOLBin) for executing PowerShell scripts.

ConstellationLiving off the Land · lolbins

lolbinwindowspowershell

Read note

Living off the Land

2023-04-17

lolbins

Living of the Land - OneDrive (Windows Store Version) - Download History Manipulation?

Exploring the OneDrive application (Windows Store version) and its download history file, and how it can be manipulated to create fake entries in the download history interface.

ConstellationLiving off the Land · lolbins

lolbinwindowsonedrive

Read note

Living off the Land

2023-04-17

lolbins

Living of the Land - Winget - Detection & DFIR

Winget is the windows Windows Package Manager that let users install, update or delete windows packages/software.

ConstellationLiving off the Land · lolbins

lolbinwindowsdfir

Read note

Living off the Land

2023-04-15

lolbins

Living of the Land - DumpMinitool.exe

Exploring the DumpMinitool.exe utility, its functionality, and how it can be used as a Living off the Land Binary (LOLBin) for dumping process memory.

ConstellationLiving off the Land · lolbins

lolbinwindowsmemory-dump

Read note

Living off the Land

2023-04-15

lolbins

Living of the Land - Microsoft.NodejsTools.PressAnyKey.exe

Deep dive into the Microsoft.NodejsTools.PressAnyKey.exe utility, its functionality, and how it can be used as a Living off the Land Binary (LOLBin) for proxy execution.

ConstellationLiving off the Land · lolbins

lolbinwindowscommand-execution

Read note