LOLBAS

Addinutil.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

AppInstaller.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Aspnet_Compiler.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

At.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Atbroker.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Bash.yml

Wsl and bash (#468 )

2025-12-06 22:02:52 +00:00

Bitsadmin.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Certoc.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Certreq.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Certutil.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Change.yml

Add RDS Binaries (#453 )

2025-09-10 19:08:49 +01:00

Cipher.yml

Adding cipher.exe entry (#274 )

2026-03-16 12:30:32 +00:00

Cmd.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Cmdkey.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Cmdl32.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Cmstp.yml

Add new Proxy Execution techniques for dxcap.exe and cmstp.exe (#489 )

2026-03-16 13:33:27 +00:00

Colorcpl.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

ComputerDefaults.yml

Add ComputerDefaults.yml (#400 )

2024-09-25 23:47:41 +01:00

ConfigSecurityPolicy.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Conhost.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Control.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Csc.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Cscript.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

CustomShellHost.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

DataSvcUtil.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Desktopimgdownldr.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

DeviceCredentialDeployment.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Dfsvc.yml

Updates for ATT&CK v17

2025-04-26 20:23:10 +01:00

Diantz.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Diskshadow.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Dnscmd.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Esentutl.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Eudcedit.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Eventvwr.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Expand.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Explorer.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Extexport.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Extrac32.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Findstr.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Finger.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

FltMC.yml

Update old sigma link (#303 )

2023-10-18 11:30:34 -04:00

Forfiles.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Fsutil.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ftp.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Gpscript.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Hh.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ie4uinit.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Iediagcmd.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ieexec.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ilasm.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

IMEWDBLD.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Infdefaultinstall.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Installutil.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Iscsicpl.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Jsc.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ldifde.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Makecab.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Mavinject.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Microsoft.Workflow.Compiler.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Mmc.yml

Update Mmc.yml (#437 )

2025-06-01 13:04:47 +01:00

Mofcomp.yml

Create Mofcomp.yml (#513 )

2026-07-31 15:59:39 -04:00

MpCmdRun.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Msbuild.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Msconfig.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Msdt.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

msedge_proxy.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Msedge.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

msedgewebview2.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Mshta.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Msiexec.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Msoxmled.yml

Update Msoxmled.yml (#512 )

2026-06-16 19:35:36 +01:00

Netsh.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ngen.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

odbcad32.yml

UAC bypass via odbcad32.exe GUI (#460 )

2026-03-14 11:59:51 +00:00

Odbcconf.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

OfflineScannerShell.yml

Adding tags (closes #9 , #318 ) (#362 )

2024-04-03 11:53:36 -04:00

OneDriveStandaloneUpdater.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Pcalua.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Pcwrun.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Pktmon.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Pnputil.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Presentationhost.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Print.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

PrintBrm.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Provlaunch.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Psr.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Query.yml

Add RDS Binaries (#453 )

2025-09-10 19:08:49 +01:00

Rasautou.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Rdrleakdiag.yml

Improve GitHub Actions workflows (#467 )

2025-10-02 18:14:34 +01:00

Reg.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Regasm.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Regedit.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Regini.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Register-cimprovider.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Regsvcs.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Regsvr32.yml

Update Regsvr32.yml (#461 )

2025-09-29 21:55:00 +01:00

Replace.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Reset.yml

ADD reset.exe (#454 )

2025-09-10 18:40:42 +01:00

Rpcping.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Rundll32.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Runexehelper.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Runonce.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Runscripthelper.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Sc.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Schtasks.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Scp.yml

Updates to scp.exe, sftp.exe and new outlook.exe entry (#265 )

2026-06-15 22:03:43 +01:00

Scriptrunner.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Setres.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

SettingSyncHost.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

setupugc.yml

Create setupugc.yml for OS binaries configuration

2026-06-15 23:40:28 +01:00

Sftp.yml

Updates to scp.exe, sftp.exe and new outlook.exe entry (#265 )

2026-06-15 22:03:43 +01:00

Sigverif.yml

Added Sigverif.yml (#469 )

2026-03-14 11:48:31 +00:00

Ssh.yml

Add PKCS11Provider option for remote DLL loading in Ssh.yml (#515 )

2026-07-28 22:27:29 +01:00

Stordiag.yml

Adding Execute tags to most LOLBas (#405 )

2024-12-29 17:31:01 +00:00

Syncappvpublishingserver.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Tar.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Ttdinject.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Tttracer.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Unregmp2.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Vbc.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Verclsid.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Wab.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Wbadmin.yml

docs: 📚 Add Detection Sigma ref (#451 )

2025-07-22 21:27:15 +01:00

Wbemtest.yml

Added wbemtest.exe (#430 )

2025-04-26 20:27:13 +01:00

Winget.yml

Update Winget.yml (#436 )

2025-06-01 13:15:55 +01:00

Wlrmdr.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Wmic.yml

Update Wmic.yml (#432 )

2026-06-29 19:16:07 -04:00

WorkFolders.yml

Add App Paths Hijacking (Proxy Execution) to WorkFolders.exe (#490 )

2026-03-16 13:43:24 +00:00

write.yml

Create write.yml (#440 )

2026-03-16 13:19:47 +00:00

Wscript.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Wsreset.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

wt.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Wuauclt.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00

Xwizard.yml

Generalising file paths and urls, see #10 (#422 )

2025-01-28 11:15:01 +00:00