Which term is used to describe the tactic of using legitimate Windows binaries for malicious purposes?

Which term is used to describe the tactic of using legitimate Windows binaries for malicious purposes?

• A. LOLBin
• B. Living off the Land Binaries
• C. Code signing certificates
• D. Phishing templates

Answer: (A)

Using legitimate Windows binaries to perform malicious actions is described by the term LOLBin. Attackers repurpose trusted system executables—like cmd.exe, powershell.exe, mshta.exe, regsvr32.exe, certutil.exe, and others—to carry out tasks such as downloading payloads, executing commands, or exfiltrating data. Because these tools are legitimate parts of the OS, they can blend in with normal activity, making detection harder unless security monitoring focuses on unusual usage patterns, atypical arguments, or suspicious parent-child process relationships. The expanded form, Living off the Land Binaries, conveys the same idea, but the shorthand LOLBin is the commonly used label for this tactic.

Using legitimate Windows binaries to perform malicious actions is described by the term LOLBin. Attackers repurpose trusted system executables—like cmd.exe, powershell.exe, mshta.exe, regsvr32.exe, certutil.exe, and others—to carry out tasks such as downloading payloads, executing commands, or exfiltrating data. Because these tools are legitimate parts of the OS, they can blend in with normal activity, making detection harder unless security monitoring focuses on unusual usage patterns, atypical arguments, or suspicious parent-child process relationships. The expanded form, Living off the Land Binaries, conveys the same idea, but the shorthand LOLBin is the commonly used label for this tactic.