awesome-lol-commonly-abused

Intended features of legitimate programs exploitable as argument injection vectors.

Known malicious bootloaders for various operating systems.

Bring Your Own Land (BYOL): Executing custom C#-based assemblies entirely within memory to reduce reliance on tools present on the target system.

Encyclopedia of evasion and anti-debug techniques.

File extensions being used by attackers, tagged by function and operating system.

Unix binaries that can be manipulated for argument injection, possibly resulting in security vulnerabilities.

Tunneling software and services, including self-hosted alternatives to ngrok and Cloudflare Tunnel, commonly abused for C2 and exfiltration.

C2 frameworks that leverage legitimate services to evade detection.

Data exfiltration reference covering LOLBins, RMM tools, cloud storage, tunneling protocols, and more, each with detection patterns, simulation commands, DFIR artifacts, IOCs, and ATT&CK mappings.

Living Off Trusted Sites: Legitimate popular domains abused for phishing, C2, exfiltration, and tool delivery to evade detection.

Living Off the Tunnels: Legitimate tunneling services abused for exfiltration, persistence, and shell access.

Living Off The Webhooks: Webhook services abused for data exfiltration and C2 communications.

Azure application names and IDs.

Azure application IDs linked to security, data handling, and compliance information.

Maps IPs and domains to Azure service tags, regions, and data centers; useful for identifying when Azure services are abused to masquerade as legitimate Microsoft traffic.

First-party applications including their pre-consented permissions in Microsoft Entra ID, apps vulnerable to ConsentFix/AuthCodeFix, and those with default exceptions from conditional access policies.

Encyclopedia of attacks/tactics/techniques for cloud exploitation.

Real-world abused APIs across Windows, Cloud, and Browser platforms with detection strategies, mitigation guidance, and red team POCs.

Living off the False Positive: Autogenerated collection of false positives sourced from popular rule sets.

Living Off Security Tools: Security tools used by adversaries to bypass security controls and carry out attacks.

Living Off The Leaked Certificates: Code signing certificates known to have been leaked or stolen, then abused by threat actors.

Living Off the Pipeline: Inventories how development tools (typically CLIs) commonly used in CI/CD pipelines have lesser-known RCE-By-Design features ("foot guns").