<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting LOLBin Abuse — API Reference

## LOLBAS Project

### Query Format

```
https://lolbas-project.github.io/api/<binary>.json
```

### Categories

| Function | Description |
|----------|-------------|
| Execute | Execute arbitrary code/commands |
| Download | Download files from remote |
| Upload | Upload/exfiltrate files |
| AWL Bypass | Application Whitelisting bypass |
| Compile | Compile code on target |
| Copy | Copy files |
| Decode | Decode encoded content |
| Encode | Encode content |

## GTFOBins

### Query Format

```
https://gtfobins.github.io/gtfobins/<binary>/
```

### Categories

- Shell, File Upload/Download, SUID, Sudo, Capabilities
- Reverse Shell, Bind Shell, File Read, File Write

## Sysmon Configuration for LOLBin Monitoring

```xml
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <Image condition="end with">certutil.exe</Image>
      <Image condition="end with">mshta.exe</Image>
      <Image condition="end with">regsvr32.exe</Image>
      <Image condition="end with">rundll32.exe</Image>
      <Image condition="end with">msbuild.exe</Image>
      <Image condition="end with">bitsadmin.exe</Image>
      <Image condition="end with">wmic.exe</Image>
      <Image condition="end with">cmstp.exe</Image>
      <Image condition="end with">installutil.exe</Image>
    </ProcessCreate>
  </EventFiltering>
</Sysmon>
```

## Sigma — LOLBin Rule Pack

```bash
# Download LOLBin-specific Sigma rules
git clone https://github.com/SigmaHQ/sigma.git
ls sigma/rules/windows/process_creation/proc_creation_win_lolbin_*

# Convert to Splunk
sigma convert -t splunk -p splunk_cim \
    sigma/rules/windows/process_creation/proc_creation_win_lolbin_certutil.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows \
    sigma/rules/windows/process_creation/proc_creation_win_lolbin_certutil.yml
```

## auditd — Linux LOLBin Monitoring

```bash
# Monitor common GTFOBin abuse vectors
auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/find -k gtfobins
auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/python3 -k gtfobins
auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/curl -k gtfobins
auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/wget -k gtfobins

# Search audit logs
ausearch -k gtfobins --format text
```
