What is a Lollib | Definition and Meaning

A Live off the Land Binary, or a Lolbin is a legitimate system binary such as a DLL that comes shipped with Windows operating systems that an attacker can leverage in attacks such as a fileless malware attack. The Lolbin definition may also include legitimate and signed administration tools that are not pre-installed, but that can be downloaded from official Windows sources. For example, PsExec.

Thousands of DLLs come pre-installed with Windows, and are a shared pool of resources used for legitimate purposes, designed to lower Windows program size (DLLs account for several GBs of Windows installs) and to avoid re-inventing the wheel. With so many DLLs there is a risk of misuse from known and unknown vulnerabilities. DLL Search Order Hijacking and DLL side loading makes it easier for an attack to further hijack other DLLs. Lolbins have a disproportinately high usage by Advaned Persistent Threats (APTs).

Lolbin Examples:

Also called:

• Live off the Land Binary
• Living off the Land Binary
• LotlBin
• Lolbin

See also:

• Lolbin
• Lolscript
• Fileless Malware
• Living off the Land Attack

For a community-maintained list of examples, see the Lolbas Github project.