Look up a binary/tool across all LOL catalogs (GTFOBins, LOLBAS, LOOBins, LOLDrivers, LOLRMM). Returns all known techniques, detection rules, cross-platform equivalents, and chain potential.

Search LOL techniques by function, ATT&CK ID, platform, stealth score, catalog, keyword, detection coverage, or combined filters. Returns matching entries with full details.

Manage the LOL knowledge base: update all catalogs from upstream, update a specific catalog, show diffs, or display statistics.

Parse host enumeration data (linpeas, winpeas, manual output), match against LOL knowledge base, and create an environment session for follow-up analysis. Returns matched binaries, attack surface summary, and top quick-win escalation paths.

Find and rank all privilege escalation paths in an enumerated environment. Supports stealth-priority ranking, multi-step chains, token abuse paths, and container escape detection.

Discover multi-step attack chains in an enumerated environment. Chains combine escalation, persistence, lateral movement, and exfiltration steps into coherent attack narratives with reasoning.

Analyze Windows token privileges in an enumerated environment and map them to known abuse techniques, potato attacks, and LOL binaries for privilege escalation.

Deep analysis of a specific binary across all LOL catalogs. Returns full technique details, chain potential, detection surface analysis, functional alternatives, and computed risk score.

Multi-mode environment analysis: compute risk scores, map attack surface, prioritize objectives, compare environments, or generate attack timelines.

Cross-platform LOL binary comparison: find equivalents between platforms, compute coverage differences, assess portability of techniques, and build unified attack chains across environments.

Find persistence mechanisms using LOL binaries — cron jobs, services, registry keys, startup items, launch agents, scheduled tasks, and DLL persistence.

Find COM object abuse techniques — hijacking, DCOM lateral movement, execution proxying, scriptlet loading.

Find lateral movement techniques using LOL binaries — SSH, WinRM, SMB, RDP, credential reuse, and WMI.

Find named pipe abuse techniques — impersonation, C2 channels, relay, and discovery.

Find credential access techniques — file harvesting, memory dumps, keychain access, registry credentials, token theft, and cached credentials.

Find WMI abuse techniques — persistence via event subscriptions, lateral movement, process execution, reconnaissance.

Find execution proxy techniques — signed binary proxy execution, compile-and-execute, script hosts, WMI execution, MMC snap-in abuse.

Find initial access techniques using LOL binaries — download-and-execute, compile, script hosts, macro execution, HTA execution.

Find package manager abuse techniques — npm lifecycle hooks, pip setup.py, gem hooks, cargo build scripts.

Find discovery and enumeration techniques using LOL binaries — native enumeration, network scanning, service/user/file enumeration.

Find collection techniques using LOL binaries — file reading, screen capture, clipboard access, input capture.

Find exfiltration techniques using LOL binaries — HTTP, DNS, LOTS (Living off Trusted Sites), tunnels, ADS streams, ICMP.

Find C2 communication channels using LOL binaries and trusted services — LOLC2, LOTS, tunneling, webhooks, DNS, protocol abuse.

Find native cryptographic and encoding techniques using LOL binaries — certutil, openssl, gpg, base64, PowerShell.

Find defense evasion techniques — EDR bypass, AMSI bypass, AppLocker bypass, obfuscation, DLL sideloading, driver loading, ADS hiding, timestomping

Find process manipulation techniques — parent PID spoofing, process hollowing, LOL binary injection, doppelganging, herpaderping

Find environment variable abuse techniques — PATH hijacking, LD_PRELOAD, DYLD_INSERT_LIBRARIES, DLL search order, COMSPEC abuse

Find anti-forensics techniques — log clearing, artifact deletion, timestomping, logging disable, track covering, shadow copy manipulation

Find DLL hijacking techniques — search order hijacking, known vulnerable apps, phantom DLLs, sideloading, proxying, validation

Generate LOL binary payload information — command execution, reverse shells, bind shells, file read, file write payloads from the knowledge base

Obfuscate commands using LOL techniques — glob wildcards, encoding, alternative binaries, string concatenation, environment variable substitution

Chain multiple obfuscation layers together for multi-layer command obfuscation

Staged payload techniques — compression, encoding, filesystem hiding, scheduled extraction using native OS tools

Analyze operational security risk — noise level, log footprint, EDR trigger probability, and safer alternatives for a given command

Build structured attack plans from environment assessment — plan generation, scoring, optimization, and export

Scan and analyze drivers against LOLDrivers database — hash lookup, name lookup, BYOVD candidates, certificate checking, vulnerable driver matching.

Find RMM (Remote Monitoring & Management) tool abuse techniques — installed tool check, persistence paths, detection artifacts, lateral pivoting, silent installation.

Find CI/CD pipeline abuse techniques — tool lookup from LOTP catalog, footgun search, pipeline poisoning, config exploitation, supply chain attacks.

Find cloud CLI abuse techniques — AWS CLI, gcloud, Azure CLI, kubectl, and Terraform for reconnaissance, privilege escalation, persistence, and data access.

Find container and Docker escape techniques — Docker socket abuse, privileged container escape, CAP_SYS_ADMIN abuse, nsenter breakout, cgroup escape.

Find macOS TCC (Transparency, Consent, and Control) bypass techniques — TCC bypass, entitlement abuse, SIP circumvention, Gatekeeper bypass.

Query WADComs (Windows/Active Directory Commands) database — search commands, filter by attack type, service, or required tool for AD attacks.

Map threat actor TTPs to LOL binary techniques — actor-to-technique lookup, technique-to-actor reverse mapping, actor profiles, campaign analysis, and environment-based actor prediction.

Simulate adversary behavior using LOL binaries — select simulation profile, generate playbook, validate environment, create execution plan.

Track evolution of LOL binary techniques over time — usage history, OS version changes affecting techniques, and deprecated/removed techniques.

Identify LOL technique from forensic evidence — command line analysis, Sysmon events, process trees, EDR alerts.

Analyze forensic artifacts for LOL technique indicators — Windows Event Logs, Process Monitor traces, EDR alerts, network captures.

Correlate incident timeline events to LOL techniques — map events, identify attack sequences, reconstruct attack chains from evidence.

Assess detection coverage gaps for LOL techniques — Sigma coverage, EDR coverage, Sysmon events, priority gaps, rule recommendations, blind spots.

Generate detection rules and tests for LOL techniques — Sigma rules, YARA rules, Sysmon config, EDR queries, hunt queries, Atomic Red Team tests.

Analyze detection rule effectiveness — rule vs technique coverage, false positive estimation, bypass probability, overall rule quality scoring.

Find detection blind spots — zero coverage techniques, partial coverage gaps, evasion-possible techniques, priority-ranked blind spots.

Score red team vs blue team posture — detection coverage scoring, blind spot severity, overall security posture, improvement plan.

Map LOL techniques to MITRE ATT&CK framework — technique lookup, coverage map, Navigator layer export, heatmap, gap analysis.

Compare LOL technique behavior across OS versions — binary behavior differences, technique validity, deprecation tracking, new capabilities.

Export findings and analysis as reports — JSON, Markdown, ATT&CK Navigator layer, CSV, executive summary.

Visualize attack paths and chains — Mermaid diagrams, Graphviz DOT, ASCII trees, JSON graph data.

Generate purple team exercise plans — red team plan, blue team detection, validation steps, combined exercise.

Export MITRE Caldera-compatible profiles — adversary profiles, ability sets, operation plans.