Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Living off the Land Binaries (Windows/Linux) > Top 25 Windows LOLBAS Binaries > Flashcards

Top 25 Windows LOLBAS Binaries Flashcards

Top 25 most abused LOLBIN per the lolbas-project and chatgpt analysis.

1
Q

Front (Question)

A

Back (Answer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the folder path for Command Line Interface?

A

C:\Windows\System32\cmd.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the LOLBAS functions of C:\Windows\System32\cmd.exe?

A

Command Line Interface

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the expected use of C:\Windows\System32\cmd.exe?

A

Execute system commands, scripts, batch files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the expected parent processes for C:\Windows\System32\cmd.exe?

A

explorer.exe, services.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the expected conditions C:\Windows\System32\cmd.exe is created for?

A

User interaction, script execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are common malicious uses of C:\Windows\System32\cmd.exe?

A

Command execution, script deployment, persistence mechanisms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the folder path for Scripting Language, Automation?

A

C:\Windows\System32\powershell.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the LOLBAS functions of C:\Windows\System32\powershell.exe?

A

Scripting Language, Automation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the expected use of C:\Windows\System32\powershell.exe?

A

Automation, configuration management, task automation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the expected parent processes for C:\Windows\System32\powershell.exe?

A

explorer.exe, taskeng.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the expected conditions C:\Windows\System32\powershell.exe is created for?

A

Task scheduling, user scripts, administrative tasks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are common malicious uses of C:\Windows\System32\powershell.exe?

A

Download and execute payloads, bypassing security controls, lateral movement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the folder path for Execute DLLs?

A

C:\Windows\System32\rundll32.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the LOLBAS functions of C:\Windows\System32\rundll32.exe?

A

Execute DLLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the expected use of C:\Windows\System32\rundll32.exe?

A

Load and run DLLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the expected parent processes for C:\Windows\System32\rundll32.exe?

A

explorer.exe, taskeng.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the expected conditions C:\Windows\System32\rundll32.exe is created for?

A

DLL execution, system configuration changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are common malicious uses of C:\Windows\System32\rundll32.exe?

A

DLL injection, persistence, command execution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the folder path for Execute HTML applications?

A

C:\Windows\System32\mshta.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the LOLBAS functions of C:\Windows\System32\mshta.exe?

A

Execute HTML applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the expected use of C:\Windows\System32\mshta.exe?

A

Run HTML-based scripts and applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the expected parent processes for C:\Windows\System32\mshta.exe?

A

explorer.exe, wscript.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the expected conditions C:\Windows\System32\mshta.exe is created for?

A

Script execution, user interaction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are common malicious uses of C:\Windows\System32\mshta.exe?

A

Download and execute payloads, phishing attacks, persistence

26
Q

What is the folder path for Task scheduling?

A

C:\Windows\System32\schtasks.exe

27
Q

What are the LOLBAS functions of C:\Windows\System32\schtasks.exe?

A

Task scheduling

28
Q

What is the expected use of C:\Windows\System32\schtasks.exe?

A

Create and manage scheduled tasks

29
Q

What are the expected parent processes for C:\Windows\System32\schtasks.exe?

A

explorer.exe, taskeng.exe

30
Q

What are the expected conditions C:\Windows\System32\schtasks.exe is created for?

A

Task automation, system maintenance

31
Q

What are common malicious uses of C:\Windows\System32\schtasks.exe?

A

Persistence, privilege escalation, lateral movement

32
Q

What is the folder path for WMI Command-line tool?

A

C:\Windows\System32\wmic.exe

33
Q

What are the LOLBAS functions of C:\Windows\System32\wmic.exe?

A

WMI Command-line tool

34
Q

What is the expected use of C:\Windows\System32\wmic.exe?

A

Management and configuration of local and remote systems

35
Q

What are the expected parent processes for C:\Windows\System32\wmic.exe?

A

explorer.exe, cmd.exe

36
Q

What are the expected conditions C:\Windows\System32\wmic.exe is created for?

A

System administration, automation scripts

37
Q

What are common malicious uses of C:\Windows\System32\wmic.exe?

A

Information gathering, lateral movement, persistence

38
Q

What is the folder path for Certificate Services?

A

C:\Windows\System32\certutil.exe

39
Q

What are the LOLBAS functions of C:\Windows\System32\certutil.exe?

A

Certificate Services

40
Q

What is the expected use of C:\Windows\System32\certutil.exe?

A

Manage and manipulate certificates

41
Q

What are the expected parent processes for C:\Windows\System32\certutil.exe?

A

explorer.exe, cmd.exe

42
Q

What are the expected conditions C:\Windows\System32\certutil.exe is created for?

A

Certificate management, network security

43
Q

What are common malicious uses of C:\Windows\System32\certutil.exe?

A

Download and decode payloads, bypass security controls

44
Q

What is the folder path for Register and unregister DLLs?

A

C:\Windows\System32\regsvr32.exe

45
Q

What are the LOLBAS functions of C:\Windows\System32\regsvr32.exe?

A

Register and unregister DLLs

46
Q

What is the expected use of C:\Windows\System32\regsvr32.exe?

A

Register or unregister DLL files

47
Q

What are the expected parent processes for C:\Windows\System32\regsvr32.exe?

A

explorer.exe, cmd.exe

48
Q

What are the expected conditions C:\Windows\System32\regsvr32.exe is created for?

A

DLL management, system configuration

49
Q

What are common malicious uses of C:\Windows\System32\regsvr32.exe?

A

Bypass application whitelisting, execute remote payloads

50
Q

What is the folder path for Manage BITS jobs?

A

C:\Windows\System32\bitsadmin.exe

51
Q

What are the LOLBAS functions of C:\Windows\System32\bitsadmin.exe?

A

Manage BITS jobs

52
Q

What is the expected use of C:\Windows\System32\bitsadmin.exe?

A

Create, monitor, and manage BITS jobs

53
Q

What are the expected parent processes for C:\Windows\System32\bitsadmin.exe?

A

explorer.exe, cmd.exe

54
Q

What are the expected conditions C:\Windows\System32\bitsadmin.exe is created for?

A

Background file transfers, software updates

55
Q

What are common malicious uses of C:\Windows\System32\bitsadmin.exe?

A

Download and execute malicious files, persistence

56
Q

What is the folder path for Registry manipulation?

A

C:\Windows\System32\reg.exe

57
Q

What are the LOLBAS functions of C:\Windows\System32\reg.exe?

A

Registry manipulation

58
Q

What is the expected use of C:\Windows\System32\reg.exe?

A

Query and modify the Windows registry

59
Q

What are the expected parent processes for C:\Windows\System32\reg.exe?

A

explorer.exe, cmd.exe

60
Q

What are the expected conditions C:\Windows\System32\reg.exe is created for?

A

Registry management, system configuration

61
Q

What are common malicious uses of C:\Windows\System32\reg.exe?

A

Persistence, privilege escalation, system manipulation

Living off the Land Binaries (Windows/Linux) (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions