Living-off-the-land binaries (LOLBins) are legitimate operating-system or administrative tools that can be used to perform actions attackers might otherwise carry out with custom malware. On Windows, examples include PowerShell, WMI, and rundll32. Their presence is not inherently suspicious: administrators use these tools for routine management and troubleshooting.
Attackers may abuse LOLBins to run commands, change settings, or move through a network while blending in with normal activity. This can make detection harder, especially where such tools are widely used. Defenders should look at context and behavior-such as unusual command-line arguments, unexpected parent processes, or activity from an atypical account-rather than block every use. Monitoring and restricting unnecessary execution can help identify abuse before it leads to actions such as ransomware deployment.